The Hotel Booking Lite WordPress plugin before 4.8.5 does...
Critical severity
Unreviewed
Published
Dec 26, 2023
to the GitHub Advisory Database
•
Updated Jan 2, 2024
Description
Published by the National Vulnerability Database
Dec 26, 2023
Published to the GitHub Advisory Database
Dec 26, 2023
Last updated
Jan 2, 2024
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
References