BookingPress Pro WordPress Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing unauthenticated arbitrary file uploads has been identified in the BookingPress Pro plugin for WordPress, affecting all versions through 5.6. The issue arises from inadequate file type validation in the 'bookingpress_validate_submitted_booking_form_func' function. This vulnerability could potentially lead to remote code execution, but exploitation requires the addition of a signature custom field to the booking form.

Impact

The vulnerability allows for unauthenticated users to upload arbitrary files to the server, which could be exploited to execute malicious code remotely.

Remediation

Users are advised to update the BookingPress Pro plugin to version 5.7 or a newer patched version.