CVE-2024-11641
Published: 26 January 2025
Summary
CVE-2024-11641 is a high-severity CSRF (CWE-352) vulnerability in Vikwp Vikbooking Hotel Booking Engine \& Pms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-11641 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the VikBooking Hotel Booking Engine & PMS plugin for WordPress in all versions up to and including 1.7.2. The issue stems from missing or incorrect nonce validation on the 'save' function, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Published on 2025-01-26, it enables unauthorized modifications to plugin settings without proper authentication checks.
Unauthenticated attackers can exploit this vulnerability by tricking a site administrator into performing an action, such as clicking a malicious link, which submits a forged request to alter plugin access privileges. Once elevated, attackers with subscriber-level privileges or higher can upload arbitrary files to the affected site's server, potentially leading to remote code execution.
Advisories from Wordfence detail the vulnerability and its impacts, while the WordPress plugin trac shows changeset 3225861, which addresses the issue by adding proper nonce validation in the affected 'save' function, recommending immediate updates to patched versions beyond 1.7.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34404
Vulnerability details
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it…
more
possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in public-facing WordPress plugin directly enables exploitation of the web app (T1190) and subsequent arbitrary file upload for web shell deployment leading to RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Protects the authenticity of communications sessions against CSRF attacks like this one by requiring mechanisms such as synchronizer tokens or nonces to validate forged requests.
Enforces validation of inputs including CSRF nonces on the 'save' function to block unauthorized changes to plugin access privileges via forged requests.
Remediates the specific CSRF flaw by identifying, reporting, and applying the vendor patch (changeset 3225861) that adds proper nonce validation.