VULNERABILITY INTELLIGENCE

CVE-2022-1409

CVSS score7.2 HIGH
EPSS probability1.47%
CISA KEVNot currently listed
Published2022-05-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

Weakness classification

  • contact@wpscan.com: CWE-434

Primary references