CVE-2024-2749 - Vulnerability Details - OpenCVE

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00077.

Key SSVC decision points have not yet been added.

Vendors	Products
Vikwp	Vikbooking Hotel Booking Engine \& Pms

Configuration 1 [-]

cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/

History

Mon, 05 May 2025 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vikwp Vikwp vikbooking Hotel Booking Engine \& Pms
CPEs		cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms::::::wordpress::*
Vendors & Products		Vikwp Vikwp vikbooking Hotel Booking Engine \& Pms

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-05-10T06:00:02.386Z

Updated: 2024-08-01T19:25:41.264Z

Reserved: 2024-03-20T19:43:06.323Z

Link: CVE-2024-2749

Vulnrichment

Updated: 2024-08-01T19:25:41.264Z

NVD

Status : Analyzed

Published: 2024-05-14T15:20:41.787

Modified: 2025-05-05T17:10:37.557

Link: CVE-2024-2749

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2749", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-03-20T19:43:06.323Z", "datePublished": "2024-05-10T06:00:02.386Z", "dateUpdated": "2024-08-01T19:25:41.264Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-05-10T06:00:02.386Z"}, "title": "VikBooking < 1.6.8 - Broken Access Control", "problemTypes": [{"descriptions": [{"description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "VikBooking Hotel Booking Engine & PMS", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.6.8"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations."}], "references": [{"url": "https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-2749", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-14T18:23:11.612673Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vikbooking:hotel_booking_engine:-:*:*:*:*:*:*:*"], "vendor": "vikbooking", "product": "hotel_booking_engine", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:29:14.651Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:25:41.264Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:25:41.264Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-2749", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-14T18:23:11.612673Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vikbooking:hotel_booking_engine:-:*:*:*:*:*:*:*"], "vendor": "vikbooking", "product": "hotel_booking_engine", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-14T18:25:12.507Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "VikBooking < 1.6.8 - Broken Access Control", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "VikBooking Hotel Booking Engine & PMS", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-05-10T06:00:02.386Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2749", "state": "PUBLISHED", "dateUpdated": "2024-08-01T19:25:41.264Z", "dateReserved": "2024-03-20T19:43:06.323Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2024-05-10T06:00:02.386Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\\&_pms:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "0FDA431D-BFBE-4916-885A-F36BAFF55006", "versionEndExcluding": "1.6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations."}, {"lang": "es", "value": "El complemento VikBooking Hotel Booking Engine & PMS WordPress anterior a 1.6.8 no restringe adecuadamente el acceso a su configuraci\u00f3n, lo que permite a cualquier usuario que pueda acceder a un men\u00fa manipular solicitudes y realizar acciones no autorizadas como editar, cambiar el nombre o eliminar (categor\u00edas para ejemplo) a pesar de que la configuraci\u00f3n inicial proh\u00edbe dicho acceso. Esta vulnerabilidad se asemeja a un control de acceso roto, lo que permite a usuarios no autorizados modificar el complemento cr\u00edtico de VikBooking Hotel Booking Engine y PMS WordPress antes de las configuraciones 1.6.8."}], "id": "CVE-2024-2749", "lastModified": "2025-05-05T17:10:37.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-05-14T15:20:41.787", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}