CyberSecurity updates
Updated: 2024-10-10 06:03:22 Pacfic

Flag This

WordPress Plugin Vulnerability: Arbitrary File Upload in WP Hotel Booking - 8d

The WP Hotel Booking WordPress plugin, with over 8,000 active installations, was found to be vulnerable to arbitrary file uploads due to missing file type validation. This critical vulnerability allows authenticated attackers, with subscriber-level access, to upload malicious files, potentially leading to remote code execution and complete website takeover. Wordfence detected and reported this vulnerability, earning the researcher a bounty of $488. The ThimPress team, the plugin developer, has released a patch for version 2.1.3, which users are urged to update to immediately.

References:

  • @jos1264 - Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released - 10d
  • Help Net Security - Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows Server 2025 gets hotpatching option, without reboots - 10d
  • Vulnerability Archives ? Cybersecurity News - Critical SolarWinds Flaw Exposes 827 Instances: PoC Exploit Unveiled for CVE-2024-28987 - 10d
  • www.wordfence.com - The WP Hotel Booking WordPress plugin, with over 8,000 active installations, was found to be vulnerable to arbitrary file uploads due to missing file type validation. This critical vulnerability allows authenticated attackers, with subscriber-level access, to upload malicious files, potentially leading to remote code execution and complete website takeover. Wordfence detected and reported this vulnerability, earning the researcher a bounty of $488. The ThimPress team, the plugin developer, has released a patch for version 2.1.3, which users are urged to update to immediately. - 8d
  • Malware Analysis, News and Indicators - Latest topics - The WP Hotel Booking WordPress plugin, with over 8,000 active installations, was found to be vulnerable to arbitrary file uploads due to missing file type validation. This critical vulnerability allows authenticated attackers, with subscriber-level access, to upload malicious files, potentially leading to remote code execution and complete website takeover. Wordfence detected and reported this vulnerability, earning the researcher a bounty of $488. The ThimPress team, the plugin developer, has released a patch for version 2.1.3, which users are urged to update to immediately. - 8d
  • wordpress.org - The WP Hotel Booking WordPress plugin, with over 8,000 active installations, was found to be vulnerable to arbitrary file uploads due to missing file type validation. This critical vulnerability allows authenticated attackers, with subscriber-level access, to upload malicious files, potentially leading to remote code execution and complete website takeover. Wordfence detected and reported this vulnerability, earning the researcher a bounty of $488. The ThimPress team, the plugin developer, has released a patch for version 2.1.3, which users are urged to update to immediately. - 8d

Classification:






This site is an experimental news aggregator using feeds I personally follow. You can reach me using contacts here if you have feedback. You can also find Flathis at Mastodon.