TI-2024-02267 Aliases CVE-2024-2441 GHSA-r566-fcmc-4j3v

VikBooking < 1.6.8 - Insecure Direct Object References

LOW 36CWE-285Published 2024-05-10 · Updated 2025-03-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-285.

Summary

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0061 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed VikBooking Hotel Booking Engine & PMS (Unknown): 1.6.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	VikBooking Hotel Booking Engine & PMS	before 1.6.8	1.6.8	Patch available	CNA

VikBooking Hotel Booking Engine & PMS VendorUnknown Affected before 1.6.8 Fixed in 1.6.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms::::::wordpress::*	before 1.6.8	Vulnerable	Vikwp

cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms:*:*:*:*:*:wordpress:*:* Versions before 1.6.8 Vulnerable ·Vikwp

Remediation

Fix · CNA VikBooking Hotel Booking Engine & PMS (Unknown) Fixed in 1.6.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-05-10
VikBooking Hotel Booking Engine & PMS 1.6.8
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-02561 VikBooking < 1.6.8 - Broken Access ControlPriority MEDIUM 60
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-2441
2026-10-03 Alias added: GHSA-r566-fcmc-4j3v

References

Exploit 1

https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/

TI-2024-02561 VikBooking < 1.6.8 - Broken Access Control CVSS 3.1MEDIUM 5.9
TI-2024-12657 VikBooking < 1.7.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-10787 Cross-site request forgery in e4jvikwp VikBooking Hotel Booking Engine & PMS CVSS 3.1HIGH 8.8
TI-2023-15783 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2023-10983 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2023-10018 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences