Vulnerability Description
The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/trunk/in
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7f1283-a274-49a2-8be
- https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/trunk/in
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7f1283-a274-49a2-8be
FAQ
What is CVE-2024-4413?
CVE-2024-4413 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauth...
How severe is CVE-2024-4413?
CVE-2024-4413 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-4413?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.