Platform
wordpress
Component
eduadmin-booking
Fixed in
5.2.1
CVE-2024-54373 describes a Path Traversal vulnerability within the EduAdmin Booking plugin for WordPress. This flaw allows attackers to potentially include arbitrary files on the server, leading to sensitive data exposure or even remote code execution. The vulnerability impacts versions of EduAdmin Booking up to and including 5.2.0, with a fix available in version 5.2.1.
The Path Traversal vulnerability in EduAdmin Booking allows an attacker to bypass intended access controls and include arbitrary files from the server's filesystem. This can be exploited by crafting malicious requests that manipulate file paths, effectively tricking the application into serving files it shouldn't. Successful exploitation could lead to the disclosure of sensitive configuration files, source code, or even system files. In a worst-case scenario, an attacker could leverage this vulnerability to execute arbitrary PHP code on the server, gaining full control of the WordPress installation and potentially the underlying system. This is similar to other Local File Inclusion vulnerabilities where attackers have gained access to critical system resources.
CVE-2024-54373 was publicly disclosed on December 16, 2024. As of this writing, there is no indication of active exploitation campaigns targeting this vulnerability. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are not widely available, but the nature of Path Traversal vulnerabilities makes it likely that such exploits will emerge.
Exploit Status
EPSS
0.18% (40% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-54373 is to immediately upgrade EduAdmin Booking to version 5.2.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting file access permissions on the server, implementing a Web Application Firewall (WAF) with rules to block suspicious file inclusion attempts, or carefully reviewing and sanitizing all user-supplied input to prevent path manipulation. Monitor WordPress access logs for unusual file requests and consider implementing a file integrity monitoring system to detect unauthorized modifications. After upgrading, confirm the fix by attempting to access a non-existent file via the vulnerable endpoint and verifying that access is denied.
Actualice el plugin EduAdmin Booking a la última versión disponible. La vulnerabilidad de inclusión de archivos locales (LFI) se soluciona en versiones posteriores a la 5.2.0. Consulte el registro de cambios del plugin para obtener más detalles sobre la corrección.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-54373 is a Path Traversal vulnerability in EduAdmin Booking allowing attackers to include arbitrary files, potentially leading to sensitive data exposure or remote code execution.
You are affected if you are using EduAdmin Booking version 5.2.0 or earlier. Upgrade to version 5.2.1 to mitigate the risk.
Upgrade EduAdmin Booking to version 5.2.1 or later. If immediate upgrade is not possible, implement temporary workarounds like WAF rules and restricted file access.
As of now, there is no confirmed active exploitation, but the vulnerability's nature makes exploitation likely.
Refer to the EduAdmin Booking website or plugin repository for the official advisory and release notes.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.