PT-2022-14212 · WordPress · Free Booking Plugin For Hotels

Cydave · Published 2022-07-11 · Updated 2026-01-23 · CVE-2022-1952

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin versions prior to 1.1.16

Description The issue arises from insufficient input validation, leading to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. Although an allowlist of valid file extensions is defined, it is not used during the validation steps.

Recommendations For versions prior to 1.1.16, update to version 1.1.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX action affected by this issue until a patch is available. Additionally, review and enforce the allowlist of valid file extensions to prevent unauthorized file uploads.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-1952

Affected Products

Free Booking Plugin For Hotels

References · 6

• 🔥 https://wpscan.com/vulnerability/ecf61d17-8b07-4cb6-93a8-64c2c4fbbe04 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1952 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1952 · Vendor Advisory
• https://t.me/cveNotify/149749 · Telegram Post
• https://t.me/cibsecurity/45914 · Telegram Post
• https://t.me/cvenotify/33172 · Telegram Post