Arbitrary File Uploads Vulnerability in WP Hotel Booking Plugin

CVE-2024-7855

Summary

The WP Hotel Booking plugin for WordPress is susceptible to an arbitrary file upload vulnerability stemming from inadequate file type validation in the update_review() function. This vulnerability is present in all versions up to and including 2.1.2. Authenticated users, including those with subscriber-level access and higher, can exploit this weakness to upload malicious files, potentially leading to remote code execution on the affected site's server. Site administrators are urged to take immediate action to mitigate this risk by updating the plugin and implementing security best practices.

References