CVE-2022-1952

CVE-2022-1952: eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload

Vendor Unknown

Product Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC

Weakness CWE-434 · Unrestricted file upload

Published July 11, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.

Key dates

02Disclosure timeline

July 11, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1952 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-9475 SourceCodester Human Resource Information System editemployee_process.php unrestricted upload CVE-2025-10371 eCharge Hardy Barth Salia PLCC api.php unrestricted upload CVE-2023-37289 InfoDoc Document On-line Submission and Approval System - Arbitrary File Upload CVE-2023-6979 Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload CVE-2022-2268 WP All Import < 3.6.8 - Admin+ Arbitrary File Upload