{"id":"CVE-2023-5991","aliases":["EUVD-2023-58258","GHSA-5c4q-4rqx-7fcj"],"status":"published","title":"Hotel Booking Lite \u003c 4.8.5 - Unauthenticated Arbitrary File Download \u0026 Deletion","description":"The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03313,"percentile":0.88668,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2023-12-26T18:33:14Z","modified":"2026-06-17T06:49:48Z","exploits":[{"source":"nuclei","id":"CVE-2023-5991","title":"Hotel Booking Lite \u003c 4.8.5 - Arbitrary File Download \u0026 Deletion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5991.yaml"}],"products":[{"vendor":"jetmonsters","product":"hotel booking lite"},{"vendor":"motopress","product":"hotel_booking_lite"},{"vendor":"unknown","product":"hotel booking lite"}],"references":[{"url":"https://wpscan.com/vulnerability/e9d35e36-1e60-4483-b8b3-5cbf08fcd49e","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5991"},{"url":"https://github.com/advisories/GHSA-5c4q-4rqx-7fcj"}],"sources":{"cve":[{"id":"CVE-2023-5991","title":"Hotel Booking Lite \u003c 4.8.5 - Unauthenticated Arbitrary File Download \u0026 Deletion","description":"The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server","status":"published","published":"2023-12-26T18:33:14.275Z","modified":"2024-08-02T08:14:25.157Z","updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-58258","description":"The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server","status":"published","published":"2023-12-26T18:33:14Z","modified":"2024-08-02T08:14:25Z","updated_at":"2026-11-03T03:50:11.066935Z"}],"ghsa":[{"id":"GHSA-5c4q-4rqx-7fcj","title":"The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via...","description":"The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server","status":"published","published":"2023-12-26T21:30:33Z","modified":"2024-01-02T21:30:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:55:19.778382Z"}],"nvd":[{"id":"CVE-2023-5991","description":"The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server","status":"published","published":"2023-12-26T19:15:08.213Z","modified":"2026-06-17T06:49:48.823Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:57.117371Z"}]}}