CVE-2024-2441

Published: May 14, 2024Modified: May 5, 2025

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.

Affected (1)

Products: Vikwp: Vikbooking Hotel Booking Engine & Pms

1 product

Vikbooking Hotel Booking Engine & Pms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vikwp Vikbooking Hotel Booking Engine & Pms	Before 1.6.8

Related CWEs

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.