CVE-2024-2749

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Unknown	VikBooking Hotel Booking Engine & PMS	< 1.6.8
vikbooking	hotel_booking_engine	-

References

https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/Exploit, Third Party Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-274978.8Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.CVE-2024-274996.5Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.CVE-2024-27505.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button wid CVE-2024-275077.5libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.CVE-2024-275087.5Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.CVE-2024-27515.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_st CVE-2024-275157.2Osclass 5.1.2 is vulnerable to SQL Injection.CVE-2024-275169.8Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and ob CVE-2024-275175.4Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permi CVE-2024-275187.8An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a c CVE-2024-27525.5The Where Did You Hear About Us Checkout Field for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via order m CVE-2024-275218.0TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multip