CVE-2024-2749 VikBooking < 1.6.8 - Broken Access Control
Unauthorized users can modify critical plugin configurations due to broken access control in the VikBooking WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2749?
CVE-2024-2749 is a medium-severity missing authorization vulnerability in Unknown VikBooking Hotel Booking Engine & PMS, published on 10 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.
Weakness: CWE-284
Which versions are affected by CVE-2024-2749?
It affects 1 product.
Products include Vikwp Vikbooking Hotel Booking Engine \& Pms.
How do I fix CVE-2024-2749?
No fix has been published for CVE-2024-2749 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-2749 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2749 exists.
Other vulnerabilities in Unknown VikBooking Hotel Booking Engine & PMS
- CVE-2024-11641 Cross-site request forgery in VikBooking Hotel Booking Engine & PMS
- CVE-2024-2441 VikBooking < 1.6.8 - Insecure Direct Object References
- CVE-2023-25707 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-24396 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-13616 VikBooking < 1.7.2 - Admin+ Stored XSS
Sources
Also known as GHSA-h2jp-gf2g-f6fc.