CVE-2023-5651

WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion

Medium · published November 20, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.5th percentile
Published
2023-11-20T18:55Z
EPSS history
Timeline
  • 20 NOV 18:55Z
    WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion
    cvelistv5