CVE-2025-47498: WordPress Hotel Booking plugin <= 3.6 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking allows PHP Local File Inclusion. This issue affects Hotel Booking: from n/a through 3.6.
Other sources
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47498?
CVE-2025-47498 has been rated as a high severity vulnerability due to its potential for PHP Local File Inclusion.
How do I fix CVE-2025-47498?
To fix CVE-2025-47498, update the Nicdark Hotel Booking plugin to the latest version that addresses this vulnerability.
What systems are affected by CVE-2025-47498?
CVE-2025-47498 affects Nicdark Hotel Booking and WordPress Hotel Booking versions up to and including 3.6.
What type of vulnerability is CVE-2025-47498?
CVE-2025-47498 is categorized as a Remote File Inclusion vulnerability, specifically allowing PHP Local File Inclusion.
What can an attacker do with CVE-2025-47498?
An attacker exploiting CVE-2025-47498 can potentially include and execute arbitrary files on the server.