WordPress Plugin Vulnerabilities

Chauffeur Taxi Booking System for WordPress < 7.3 - Unauthenticated Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation, allowing unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
chauffeur-booking-system
Fixed in 7.3

References

CVE
CVE-2024-31115
URL
https://patchstack.com/database/vulnerability/chauffeur-booking-system/wordpress-chauffeur-taxi-booking-system-for-wordpress-plugin-6-9-arbitrary-file-upload-vulnerability

Miscellaneous

Original Researcher
Kursat Cetin
Verified
No
WPVDB ID
c2992284-60f3-4f04-ad2a-863a55aef94b

Timeline

Publicly Published
2024-03-29 (about 2 years ago)
Added
2024-04-03 (about 2 years ago)
Last Updated
2024-05-13 (about 2 years ago)

Other

Published
Title
Published
2024-11-15
Title
Backup and Staging by WP Time Capsule < 1.22.22 - Unauthenticated Arbitrary File Upload
Published
2021-04-10
Title
Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE
Published
2014-08-01
Title
php-analytics - ofc_upload_image.php Arbitrary File Upload
Published
2022-07-21
Title
GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE
Published
2025-10-29
Title
WavePlayer < 3.8.0 - Unauthenticated Arbitrary File Upload