CVE-2022-1952
eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 17.6%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
11 Jul 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →