PT-2026-50298 · Ovatheme+1 · Bookpro+1
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
BookPro versions prior to 1.1.1
Description
The BookPro - Appointment Booking WordPress Plugin contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation, which can lead to remote code execution if critical files, such as
wp-config.php, are deleted.Recommendations
Update the plugin to a version later than 1.1.0.
Fix
DoS
RCE
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bookpro
Ovabookpro