VikBooking Hotel Booking Engine & PMS WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the VikBooking Hotel Booking Engine & PMS plugin for WordPress, affecting all versions through 1.7.2. The vulnerability arises from inadequate nonce validation in the 'save' function, allowing unauthenticated attackers to manipulate plugin access rights by tricking an administrator into clicking a link. Exploitation of this vulnerability enables attackers with subscriber-level privileges or higher to upload arbitrary files to the site's server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for unauthorized file uploads, which might be used to execute malicious code on the server.

Remediation

Users are advised to update the VikBooking Hotel Booking Engine & PMS plugin to version 1.7.3 or later.