CVE-2024-2441

🗓️ 10 May 2024 06:00:02Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

VikBooking Hotel Booking Engine & PMS WordPress plugin vulnerabilit

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin VikBooking Hotel Booking Engine & PMS 安全漏洞	14 May 202400:00	–	cnnvd
Cvelist	CVE-2024-2441 VikBooking < 1.6.8 - Insecure Direct Object References	10 May 202406:00	–	cvelist
NVD	CVE-2024-2441	14 May 202415:19	–	nvd
Patchstack	WordPress VikBooking Hotel Booking Engine & PMS Plugin < 1.6.8 is vulnerable to Insecure Direct Object References (IDOR)	15 May 202400:00	–	patchstack
Patchstack	WordPress VikBooking plugin < 1.6.8 - Insecure Direct Object References vulnerability	15 May 202401:41	–	patchstack
Positive Technologies	PT-2024-20389 · WordPress · Vikbooking Hotel Booking Engine & Pms	10 May 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-2441	7 Jan 202609:20	–	redhatcve
Vulnrichment	CVE-2024-2441 VikBooking < 1.6.8 - Insecure Direct Object References	10 May 202406:00	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (April 15, 2024 to April 21, 2024)	25 Apr 202415:56	–	wordfence
wpexploit	VikBooking < 1.6.8 - Insecure Direct Object References	19 Apr 202400:00	–	wpexploit

NVD

Vulners

Node

vikwp vikbooking_hotel_booking_engine_&_pmsRange<1.6.8wordpress

[
  {
    "vendor": "Unknown",
    "product": "VikBooking Hotel Booking Engine & PMS",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.6.8"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/

Parameter	Position	Path	Description	CWE
option	query param	/wp-admin/admin.php?option=com_vikbooking&task=config	Direct access to plugin configuration via admin.php parameters allows privilege bypass for authenticated subscribers.	CWE-285
task	query param	/wp-admin/admin.php?option=com_vikbooking&task=config	Direct access to plugin configuration via admin.php parameters allows privilege bypass for authenticated subscribers.	CWE-285
option	query param	/wp-admin/admin.php?option=com_vikbooking&task=orders	Direct access to plugin orders via admin.php parameters allows privilege bypass for authenticated subscribers.	CWE-285
task	query param	/wp-admin/admin.php?option=com_vikbooking&task=orders	Direct access to plugin orders via admin.php parameters allows privilege bypass for authenticated subscribers.	CWE-285

05 May 2025 17:12Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.1

EPSS0.00582

SSVC

CWE-285