CVE-2022-1952

PoC —

CVSS 3.1

9.8 critical

EPSS

25%p98

Published

Jul 11, 2022 (Jul 11, 2022)

Modified

Jun 17, 2026

Description

The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.

Vendors: syntacticsinc
Products: easync
Ecosystems: WordPress
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (24.9%)

In the news0 stories

No ingested article mentions this CVE yet.