CVE-2022-1952

eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload

State: Published
Severity: Not scored
Published: Jul 11, 2022
Updated: Aug 3, 2024
Reserved: May 31, 2022

Description

The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.

Scores

The record has no CVSS score.

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNCUnknown	1.1.16 to before 1.1.16Affected

References

https://wpscan.com/vulnerability/ecf61d17-8b07-4cb6-93a8-64c2c4fbbe04

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.