CVE-2024-3022

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpressprocessupload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to...

WordPress BookingPress plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by Dian Sun in WordPress Plugin BookingPress versions = 1.0.87...

WordPress BookingPress Plugin <= 1.0.87 is vulnerable to Arbitrary File Upload

Software BookingPress Type Plugin Vulnerable versions = 1.0.87 Fixed in 1.0.88 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-3022 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 95c9a0019f7e Credits Dian Sun Required privilege Administrator...