8.1
High
CVE-2024-2441 The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an…
Description
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VikBooking Hotel Booking Engine & PMS 1.6 | earliest → < 1.6.8 | 1.6.8 |
Other CVEs of VikBooking Hotel Booking Engine & PMS
The 8 CVEs of VikBooking Hotel Booking Engine & PMS →
CVE-2026-85127
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files…
8.8
High
CVE-2024-13616
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its…
4.8
Medium
CVE-2024-2749
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly…
5.9
Medium
CVE-2022-1528
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting…
Not rated