CVE-2026-125851: WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability

Q: Can this be exploited remotely without victim interaction?

The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required. The attacker must have low-level privileges.

Q: What is the potential impact if exploitation succeeds?

The vulnerability can allow upload of a web shell to the server. The reported CVSS vector indicates high impact to confidentiality, integrity, and availability, with scope change.

Published Nov 13, 2026

Updated

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1.

Affected Software

1 affected component

themagnifico52 Hotel Booking Lite<=2.5.1

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Can this be exploited remotely without victim interaction?

The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required. The attacker must have low-level privileges.

What is the potential impact if exploitation succeeds?

The vulnerability can allow upload of a web shell to the server. The reported CVSS vector indicates high impact to confidentiality, integrity, and availability, with scope change.

CVE-2026-125851: WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability

Affected Software

Event History

Frequently Asked Questions

Can this be exploited remotely without victim interaction?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Can this be exploited remotely without victim interaction?

What is the potential impact if exploitation succeeds?