CVE-2024-11641

High

Published: 26 January 2025

Published

26 January 2025

Modified

04 February 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0127 79.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-11641 is a high-severity CSRF (CWE-352) vulnerability in Vikwp Vikbooking Hotel Booking Engine \& Pms. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-23 Session Authenticity good match

prevent

Protects the authenticity of communications sessions against CSRF attacks like this one by requiring mechanisms such as synchronizer tokens or nonces to validate forged requests.

SI-10 Information Input Validation good match

prevent

Enforces validation of inputs including CSRF nonces on the 'save' function to block unauthorized changes to plugin access privileges via forged requests.

SI-2 Flaw Remediation good match

prevent

Remediates the specific CSRF flaw by identifying, reporting, and applying the vendor patch (changeset 3225861) that adds proper nonce validation.

NVD Description

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it…

possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.

Deeper analysisAI

CVE-2024-11641 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the VikBooking Hotel Booking Engine & PMS plugin for WordPress in all versions up to and including 1.7.2. The issue stems from missing or incorrect nonce validation on the 'save' function, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Published on 2025-01-26, it enables unauthorized modifications to plugin settings without proper authentication checks.

Unauthenticated attackers can exploit this vulnerability by tricking a site administrator into performing an action, such as clicking a malicious link, which submits a forged request to alter plugin access privileges. Once elevated, attackers with subscriber-level privileges or higher can upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Advisories from Wordfence detail the vulnerability and its impacts, while the WordPress plugin trac shows changeset 3225861, which addresses the issue by adding proper nonce validation in the affected 'save' function, recommending immediate updates to patched versions beyond 1.7.2.