9.8
Critical
CVE-2022-27862 Arbitrary File Upload leading to RCE in E4J s.r.l
Description
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VikBooking Hotel Booking Engine & PMS (WordPress plugin) 1.5 | earliest → 1.5.3 | No fix stated |