CVE-2024-2441

VikBooking < 1.6.8 - Insecure Direct Object References

High · published May 10, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00610 · 48.5th percentile
Published
2024-05-10T06:00Z
EPSS history
Timeline
  • 10 MAY 06:00Z
    VikBooking < 1.6.8 - Insecure Direct Object References
    cvelistv5