CVE-2022-1409

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Unknown	VikBooking Hotel Booking Engine & PMS	>= 1.5.8, < 1.5.8

References

https://wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101feExploit, Third Party Advisory
https://wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101feExploit, Third Party Advisory

Timeline

Published: May 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14108.8OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to e CVE-2022-14116.1Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims CVE-2022-14127.5The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any u CVE-2022-14137.5Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and CVE-2022-14148.83scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to CVE-2022-14158.8A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authen CVE-2022-14165.4Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versio CVE-2022-14174.3Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9 CVE-2022-14186.1The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no CVE-2022-14197.8The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created i CVE-2022-14205.5Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.CVE-2022-14214.3The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary