Cross-Site Request Forgery in VikBooking Hotel Booking Engine & PMS Plugin by WordPress

CVE-2024-11641

What is CVE-2024-11641?

The VikBooking Hotel Booking Engine & PMS plugin on WordPress has a vulnerability that permits Cross-Site Request Forgery due to improper nonce validation in its 'save' function. This flaw permits unauthenticated attackers to induce site administrators into executing unauthorized actions, potentially altering plugin access privileges. If successfully exploited, attackers with subscriber-level access or higher may upload arbitrary files to the server, which could lead to remote code execution. It is crucial for users to update to the latest version to safeguard against these risks.

References