CVE-2024-2441 VikBooking < 1.6.8 - Insecure Direct Object References

2024-05-1006:00:02

WPScan

github.com

vikbooking

plugin

vulnerability

unauthorized access

AI Score

6.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8’s they shouldn’t be allowed to.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "VikBooking Hotel Booking Engine & PMS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.6.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]