CVE-2024-51582
📋 TL;DR
This path traversal vulnerability in the ThimPress WP Hotel Booking WordPress plugin allows attackers to include local PHP files using '.../...//' sequences. It affects all WordPress sites running WP Hotel Booking versions up to 2.1.4, potentially leading to sensitive information disclosure or remote code execution.
💻 Affected Systems
- ThimPress WP Hotel Booking WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data exfiltration, and website defacement.
Likely Case
Sensitive file disclosure including configuration files, database credentials, and user data.
If Mitigated
Limited impact with proper file permissions and web server restrictions preventing PHP execution in sensitive directories.
🎯 Exploit Status
Simple path traversal payloads can be used to include local PHP files. Public exploit details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.5 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/wp-hotel-booking/wordpress-wp-hotel-booking-plugin-2-1-4-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Hotel Booking and click 'Update Now'. 4. Verify version is 2.1.5 or higher.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the WP Hotel Booking plugin until patched
wp plugin deactivate wp-hotel-booking
Web Application Firewall Rule
allBlock requests containing path traversal sequences
Add WAF rule to block patterns like '.../...//' and '../' sequences
🧯 If You Can't Patch
- Implement strict file permissions (644 for files, 755 for directories) to limit readable files
- Use web server configuration to restrict PHP execution in sensitive directories
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for WP Hotel Booking versionCheck Version:
wp plugin get wp-hotel-booking --field=versionVerify Fix Applied:
Verify plugin version is 2.1.5 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '.../...//' sequences
- Access to unexpected PHP files via plugin endpoints
Network Indicators:
- Unusual file inclusion patterns in HTTP requests to /wp-content/plugins/wp-hotel-booking/
SIEM Query:
web.url:*wp-hotel-booking* AND (web.url:*.../...//* OR web.url:*../*)