CVE-2024-38717: Path Traversal in Booking Ultra Pro Appointments

The primary impact of this vulnerability is the ability for an attacker to leverage Path Traversal to achieve Local File Inclusion (LFI). By manipulating file paths, an attacker can trick the plugin into including files outside of its intended directory. This could expose sensitive configuration files, source code, or even system files containing credentials. Successful exploitation could lead to unauthorized access to the WordPress environment, data breaches, and potential compromise of the entire server. While direct remote code execution isn't explicitly stated, the ability to include arbitrary files opens the door to further exploitation depending on the server's configuration and the contents of the included files.

1. Reserved2024-06-19
2. Published2024-07-12
3. Modified2024-08-02
4. EPSS updated2026-04-02

The most effective mitigation for CVE-2024-38717 is to immediately upgrade the Booking Ultra Pro Appointments plugin to version 1.1.14 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These might include restricting file access permissions on the WordPress server, implementing a Web Application Firewall (WAF) rule to block suspicious path traversal attempts (e.g., patterns containing '../'), and carefully reviewing the plugin's configuration to ensure it adheres to security best practices. After upgrading, confirm the vulnerability is resolved by attempting a path traversal attack and verifying that access is denied.

Active installs

400Niche

Plugin rating