CVE-2024-2441
Assigner: WPScan
Published: 2024-05-10T06:00:02.156Z
State: PUBLISHED
title: VikBooking < 1.6.8 - Insecure Direct Object References
problemTypes: descriptions: description: CWE-639 Authorization Bypass Through User-Controlled Key
type: CWE
affected: vendor: Unknown
product: VikBooking Hotel Booking Engine & PMS
versions: status: affected
versionType: semver
version: 0
lessThan: 1.6.8
defaultStatus: unaffected
descriptions: value: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.
credits: value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator