TI-2024-02561 Aliases CVE-2024-2749 GHSA-h2jp-gf2g-f6fc

VikBooking < 1.6.8 - Broken Access Control

MEDIUM 60CWE-284Published 2024-05-10 · Updated 2024-08-01

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-284.

Summary

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0028 20th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed VikBooking Hotel Booking Engine & PMS (Unknown): 1.6.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	VikBooking Hotel Booking Engine & PMS	before 1.6.8	1.6.8	Patch available	CNA

VikBooking Hotel Booking Engine & PMS VendorUnknown Affected before 1.6.8 Fixed in 1.6.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms::::::wordpress::*	before 1.6.8	Vulnerable	Vikwp

cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms:*:*:*:*:*:wordpress:*:* Versions before 1.6.8 Vulnerable ·Vikwp

Remediation

Fix · CNA VikBooking Hotel Booking Engine & PMS (Unknown) Fixed in 1.6.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-05-10
VikBooking Hotel Booking Engine & PMS 1.6.8
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-02267 VikBooking < 1.6.8 - Insecure Direct Object ReferencesPriority LOW 36
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-2749
2026-10-03 Alias added: GHSA-h2jp-gf2g-f6fc

References

Exploit 1

https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/

TI-2024-12657 VikBooking < 1.7.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-10787 Cross-site request forgery in e4jvikwp VikBooking Hotel Booking Engine & PMS CVSS 3.1HIGH 8.8
TI-2023-15783 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2023-10983 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2024-02267 VikBooking < 1.6.8 - Insecure Direct Object References CVSS 3.1HIGH 8.1
TI-2023-10018 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences