blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-1952

CRITICAL 9.8 CVSS 3.1
Published
July 11, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.

Affected products and versions

  • Unknown Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC — From 1.1.16 (including) to 1.1.16 (excluding)
  • syntacticsinc easync — Before 1.1.16

References

  • wpscan.com https://wpscan.com/vulnerability/ecf61d17-8b07-4cb6-93a8-64c2c4fbbe04 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record