WordPress Plugin Vulnerabilities

VikBooking Hotel Booking Engine & PMS < 1.5.4 - Unauthenticated Arbitrary File Upload

Description

The plugin does not properly validate the signature file uploaded via its booking form, which could allow unauthenticated attacker to upload arbitrary files

Affects Plugins

Plugin icon
vikbooking
Fixed in 1.5.4

References

CVE
CVE-2022-27862

Miscellaneous

Original Researcher
Huli
Verified
No
WPVDB ID
60592253-b422-47f7-8b0b-05689b31bae2

Timeline

Publicly Published
2022-04-18 (about 4 years ago)
Added
2022-04-20 (about 4 years ago)
Last Updated
2022-04-21 (about 4 years ago)

Other

Published
Title
Published
2025-02-14
Title
Chaty Pro < 3.3.4 - Unauthenticated Arbitrary File Upload
Published
2024-03-07
Title
Elite Booster for WooCommerce < 7.1.8 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-04-01
Title
EnvíaloSimple: Email Marketing y Newsletters < 2.4 - Arbitrary File Upload via CSRF
Published
2025-03-28
Title
Inline Image Upload for BBPress < 1.1.20 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2026-02-25
Title
AI Engine < 3.3.3 - Editor+ Arbitrary File Upload