The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/e9d35e36-1e60-4483-b8b3-5cbf08fcd49e | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/e9d35e36-1e60-4483-b8b3-5cbf08fcd49e | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 08:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/e9d35e36-1e60-4483-b8b3-5cbf08fcd49e - Exploit, Third Party Advisory |
02 Jan 2024, 20:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/e9d35e36-1e60-4483-b8b3-5cbf08fcd49e - Exploit, Third Party Advisory | |
| First Time |
Motopress hotel Booking Lite
Motopress |
|
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:motopress:hotel_booking_lite:*:*:*:*:*:wordpress:*:* |
26 Dec 2023, 20:34
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-26 19:15
Updated : 2024-11-21 08:42
NVD link : CVE-2023-5991
Mitre link : CVE-2023-5991
CVE.ORG link : CVE-2023-5991
JSON object : View
Products Affected
motopress
- hotel_booking_lite
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')