VikBooking < 1.6.8 - Insecure Direct Object References

2024-04-1900:00:00

cyc707

vikbooking insecure objectreferences poc may032024 userupdate exploit

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the plugin’s they shouldn’t be allowed to.

https://example.com/wp-admin/admin.php?option=com_vikbooking&task=config
https://example.com/wp-admin/admin.php?option=com_vikbooking&task=orders