Local File Inclusion Vulnerability in Nicdark Hotel Booking Plugin
CVE-2025-53259

7.5HIGH

Key Information:

Vendor

WordPress
Status
Hotel Booking
Vendor
CVE Published:
27 June 2025

What is CVE-2025-53259?

The Nicdark Hotel Booking plugin is susceptible to a Local File Inclusion vulnerability due to improper control of filename during include or require statements. This flaw can potentially allow attackers to exploit the system, leading to unauthorized access to sensitive files or data within the server's file system. The vulnerability is present in versions from n/a through 3.7, posing a risk to websites utilizing this plugin. Users are recommended to review their configurations and update their installations to mitigate this security threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Hotel Booking <= 3.7

References

https://patchstack.com/database/wordpress/plugin/nd-booki...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
JSON
.