CVE-2019-15774

The ND Booking WordPress plugin (versions prior to 2.5 ) is vulnerable to an Unauthenticated Options Change security flaw. An unauthenticated attacker can exploit a nopriv_ AJAX action to modify the siteurl setting or other plugin options. This could allow an attacker to enable development mode, ...