CVE-2024-2749

5.9 mediumEPSS 0.3%

Medium (5.9) in vikwp vikbooking hotel booking engine \& pms. EPSS 0.3% chance of exploitation in the next 30 days.

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.

Severity

CVSS 3.1

5.9 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2024-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vikwp:vikbooking_hotel_booking_engine_\&_pms

References

Check your stack JSON