CVE-2024-51582 WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability
Attackers can exploit a path traversal flaw in the WP Hotel Booking plugin to include arbitrary local files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-51582?
CVE-2024-51582 is a high-severity path traversal vulnerability in ThimPress WP Hotel Booking, published on 4 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: from n/a through <= 2.2.9.
Which versions are affected by CVE-2024-51582?
It affects 1 product.
Products include Thimpress Wp Hotel Booking.
How do I fix CVE-2024-51582?
No fix has been published for CVE-2024-51582 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-51582 being exploited?
There is no known exploitation of CVE-2024-51582 in the wild and no public exploit code.
Other vulnerabilities in ThimPress WP Hotel Booking
- CVE-2024-3605 WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
- CVE-2023-5652 WP Hotel Booking < 2.0.8 - Unauthenticated SQLi
- CVE-2020-29047 Deserialization in n/a
- CVE-2024-7855 WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-30508 WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability
Sources
Also known as GHSA-gpj2-23jf-pgq2.