Unrestricted File Upload Vulnerability in Hotel Booking Lite by Themagnifico52
CVE-2026-125851

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Hotel Booking Lite
Vendor
CVE Published:
13 November 2026

What is CVE-2026-125851?

The Hotel Booking Lite plugin by Themagnifico52 suffers from an unrestricted file upload vulnerability, allowing unauthorized users to upload malicious files to the web server. This vulnerability potentially enables attackers to deploy a web shell, granting them the ability to execute arbitrary commands on the server, leading to further exploitation of the system. Affected versions include all prior to 2.5.1, emphasizing the need for immediate patching to mitigate risks.

Affected Version(s)

Hotel Booking Lite 0 <= 2.5.1

References

https://patchstack.com/database/wordpress/theme/hotel-boo...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

beopseong.kim | Patchstack Bug Bounty Program
.