CVE-2024-7855

Name of the Vulnerable Software and Affected Versions WP Hotel Booking plugin for WordPress versions up to, and including, 2.1.2

Description The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update review() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For WP Hotel Booking plugin for WordPress versions up to, and including, 2.1.2: Update the plugin to a version that includes the fix for this issue. As a temporary workaround, consider disabling the update review() function until a patch is available. Restrict access to the plugin's file upload functionality to minimize the risk of exploitation.