ND Booking < 2.5 - Unauthenticated Options Change

The Hotel Booking WordPress plugin ND Booking 2.5 was affected by an Unauthenticated Options Change security vulnerability. id: CVE-2019-15774 info: name: ND Booking 2.5 - Unauthenticated Options Change author: popcorn94 severity: medium description: | The Hotel Booking WordPress plugin ND Bookin...

CVE-2019-15774

The ND Booking WordPress plugin (versions prior to 2.5 ) is vulnerable to an Unauthenticated Options Change security flaw. An unauthenticated attacker can exploit a nopriv_ AJAX action to modify the siteurl setting or other plugin options. This could allow an attacker to enable development mode, ...

VulnCheck KEV: CVE-2019-15774

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...