Arbitrary PHP File Inclusion Vulnerability in Restaurant Reservations Plugin for WordPress

CVE-2024-1382

Summary

The Restaurant Reservations plugin for WordPress is affected by a Local File Inclusion vulnerability. This issue arises from the improper handling of the nd_rst_layout attribute within the nd_rst_search shortcode. Authenticated attackers with contributor-level access can exploit this vulnerability to include and execute arbitrary PHP files on the server. The malicious execution of PHP code opens avenues for bypassing access controls, potentially exposing sensitive information, and executing code through uploaded PHP files that may not be directly accessible, thus posing significant risks to WordPress sites utilizing this plugin.

References