CVE-2024-2441

VikBooking < 1.6.8 - Insecure Direct Object References

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.

Affected

VikBooking Hotel Booking Engine & PMS

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.61% chance of exploitation in the next 30 days, 48th percentile

Published

2024-05-10

Updated

2025-03-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/

Security advisories

• https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79

References

• CVE Record
• NVD entry