WordPress Movie Booking Plugin <= 1.1.5 - Arbiträres Löschen von Dateien Schwachstelle

The Arbitrary File Access vulnerability allows an attacker to bypass intended security restrictions and access files outside of the intended directory. In the context of the ovatheme Movie Booking plugin, this could allow an attacker to read configuration files, database credentials, or even source code from the web server. Successful exploitation could lead to information disclosure, privilege escalation, and potentially complete compromise of the WordPress instance. The impact is amplified if the server hosts other sensitive applications or data.

WordPress websites utilizing the Ovatheme Movie Booking plugin, particularly those running versions 0.0.0 through 1.1.5, are at risk. Shared hosting environments where users have limited control over plugin installations are especially vulnerable, as are sites with default or weak file permissions.

• wordpress / composer / npm:

grep -r '../' /var/www/html/wp-content/plugins/movie-booking/*

• generic web:

curl -I 'http://your-wordpress-site.com/wp-content/plugins/movie-booking/../../../../etc/passwd'

• wordpress / composer / npm:

wp plugin list --status=inactive | grep movie-booking

1. 2026-01-22Disclosure

   disclosure

1. Reserviert2025-12-15
2. Veröffentlicht2026-01-22
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-67963 is to immediately upgrade the ovatheme Movie Booking plugin to version 1.1.6 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on the WordPress installation to minimize the potential damage from a successful exploit. After upgrading, verify the fix by attempting to access files outside the plugin's intended directory via a web browser; access should be denied.