HIGH🇵🇱 Wersja polska

CVE-2024-3022

CVSS 7.2v3.1pub. 2024-04-04upd. 2026-04-08

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_process_upload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to upload arbitrary files on the affected site's server, enabling remote code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Reputeinfosystems Bookingpress

    APP
    Reputeinfosystems
    ≤ 1.0.87
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2022-0739CRITICAL9.8ten sam produkt

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it i...

CVE-2025-31910HIGH7.6ten sam produkt

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputein...

CVE-2024-6467HIGH8.8ten sam produkt

The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vu...

CVE-2024-6660HIGH8.8ten sam produkt

The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vu...

CVE-2023-51405HIGH8.2ten sam produkt

Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Pr...