Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-27862

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Patchstack

Description

Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

E4J s.r.l. VikBooking Hotel Booking Engine & PMS (WordPress plugin)

  • <= 1.5.3 to ≤ 1.5.3affected

References