PT-2023-32237 · WordPress · Wp Hotel Booking

Krzysztof Zając · Published 2023-11-20 · Updated 2024-10-01 · CVE-2023-5651

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.0.8

Description The issue concerns a lack of authorization and CSRF checks in the WP Hotel Booking WordPress plugin, which also fails to verify that the item to be deleted is indeed a package. This allows any authenticated user, including those with minimal privileges like subscribers, to delete arbitrary posts.

Recommendations For versions prior to 2.0.8, update to version 2.0.8 or later to resolve the issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-5651

Affected Products

Wp Hotel Booking

References · 4

• 🔥 https://wpscan.com/vulnerability/a365c050-96ae-4266-aa87-850ee259ee2c · Exploit
• https://osv.dev/vulnerability/CVE-2023-5651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5651 · Security Note
• https://t.me/cvenotify/96694 · Telegram Post