CVE-2024-2441

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.61% chance of exploitation in the next 30 days, 47th percentile

Published

2024-05-10

Updated

2025-03-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/

References

• CVE Record
• NVD entry

Related

• CVE-2024-24409
• CVE-2024-24416
• CVE-2024-24402
• CVE-2024-24417
• CVE-2024-24401
• CVE-2024-24418