CVE-2022-27862 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE
Attackers can upload malicious files via the booking form signature upload to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27862?
CVE-2022-27862 is a critical vulnerability in E4J s.r.l. VikBooking Hotel Booking Engine & PMS (WordPress plugin), published on 19 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.
Weakness: CWE-434
Which versions are affected by CVE-2022-27862?
It affects 1 product.
Products include Vikwp Vikbooking Hotel Booking Engine \& Property Management System Plugin.
How do I fix CVE-2022-27862?
No fix has been published for CVE-2022-27862 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-27862 being exploited?
There is no known exploitation of CVE-2022-27862 in the wild and no public exploit code.
Other vulnerabilities in E4J s.r.l. VikBooking Hotel Booking Engine & PMS (WordPress plugin)
Sources
Also known as GHSA-6pj9-476v-v64v.