CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.
Explanation of Vulnerability in Simple Terms
Hotel Booking Lite versions up to 5.2.3 contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with admin or equivalent access can inject malicious code that runs with full site permissions. The vulnerability affects confidentiality, integrity, and availability of the entire installation.
What an attacker can do
Run arbitrary PHP code on the site with full permissions.
Potential impact on your site
A compromised admin account can execute any code, steal data, modify content, or take the site offline.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the site.
Key dates
External resources
