Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows PHP Local File Inclusion.This issue affects Beds24 Online Booking: from n/a through <= 2.0.28.
Published: 2025-04-04
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability arises from improper control of the filename in an include/require statement within the Beds24 Online Booking WordPress plugin. It permits local file inclusion, allowing an attacker to read arbitrary files or potentially execute code located on the server. The flaw is present in all releases through version 2.0.28. The impact may include exposure of configuration files, credentials, or other sensitive data, and in some cases could lead to remote code execution if the attacker can influence the included path.

Affected Systems

The vulnerability affects the Beds24 Online Booking plugin from markkinchin for WordPress. Specifically, all releases from the initial available version up to and including 2.0.28 are impacted. No other vendor or product versions are listed.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1 percent, signifying a low exploitation probability as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a crafted web request that manipulates the include parameter, although the exact preconditions are not detailed in the provided information.

Generated by OpenCVE AI on May 1, 2026 at 00:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Beds24 Online Booking plugin to the newest release (≥ 2.0.29) if available.
  • If an upgrade cannot be performed immediately, restrict or eliminate parameters that accept filenames used in include or require calls, and apply input validation or a whitelist of allowed paths.
  • Configure the server to limit PHP's include scope, for example by setting open_basedir or adding .htaccess rules that block direct access to sensitive directories used by the plugin.

Generated by OpenCVE AI on May 1, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-9862 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking allows PHP Local File Inclusion. This issue affects Beds24 Online Booking: from n/a through 2.0.26.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking allows PHP Local File Inclusion. This issue affects Beds24 Online Booking: from n/a through 2.0.26. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows PHP Local File Inclusion.This issue affects Beds24 Online Booking: from n/a through <= 2.0.28.
Title WordPress Beds24 Online Booking plugin <= 2.0.26 - Local File Inclusion vulnerability WordPress Beds24 Online Booking plugin <= 2.0.28 - Local File Inclusion vulnerability
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 04 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 04 Apr 2025 16:15:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking allows PHP Local File Inclusion. This issue affects Beds24 Online Booking: from n/a through 2.0.26.
Title WordPress Beds24 Online Booking plugin <= 2.0.26 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:17.654Z

Reserved: 2025-04-04T10:00:58.028Z

Link: CVE-2025-32155

cve-icon Vulnrichment

Updated: 2025-04-04T19:53:20.982Z

cve-icon NVD

Status : Deferred

Published: 2025-04-04T16:15:23.997

Modified: 2026-04-23T15:28:39.663

Link: CVE-2025-32155

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T00:45:05Z

Weaknesses