CVE-2024-3022

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpressprocessupload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to...

CVE-2024-3022

BookingPress for WordPress (all versions

CVE-2024-3022 BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpressprocessupload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to...

CVE-2024-3022 BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpressprocessupload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to...

WordPress BookingPress Plugin <= 1.0.87 is vulnerable to Arbitrary File Upload

Software BookingPress Type Plugin Vulnerable versions = 1.0.87 Fixed in 1.0.88 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-3022 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 95c9a0019f7e Credits Dian Sun Required privilege Administrator...