CVE-2024-53800
📋 TL;DR
This vulnerability allows attackers to include local files on the server through PHP's include/require statements, potentially leading to sensitive information disclosure or code execution. It affects all Rezgo Online Booking WordPress plugin installations from unknown versions through 4.15. Website administrators using this plugin should patch immediately.
💻 Affected Systems
- Rezgo Online Booking WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
Local file inclusion allowing reading of sensitive files like configuration files, logs, or source code.
If Mitigated
Limited file access within web root directory if proper file permissions are configured.
🎯 Exploit Status
Exploitation requires understanding of PHP file inclusion vulnerabilities and WordPress plugin structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Rezgo Online Booking plugin. 4. Click 'Update Now' if update available. 5. If no update available, manually download version 4.16+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable Plugin
WordPressTemporarily disable the Rezgo plugin until patching is possible.
wp plugin deactivate rezgo
Restrict File Access
allConfigure web server to restrict access to sensitive directories and files.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file inclusion patterns
- Restrict PHP execution in upload directories and disable dangerous PHP functions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Rezgo Online Booking version. If version is 4.15 or earlier, you are vulnerable.Check Version:
wp plugin get rezgo --field=versionVerify Fix Applied:
Verify plugin version is 4.16 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file paths in PHP include/require statements
- Multiple requests to plugin files with file path parameters
- Access to sensitive files like /etc/passwd or wp-config.php
Network Indicators:
- HTTP requests containing file path traversal patterns to Rezgo plugin endpoints
SIEM Query:
web.url:*rezgo* AND (web.param:*../* OR web.param:*file=*)