{"id":"CVE-2024-2441","aliases":["EUVD-2024-27391","GHSA-r566-fcmc-4j3v"],"status":"published","title":"VikBooking \u003c 1.6.8 - Insecure Direct Object References","description":"The VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0061,"percentile":0.49544,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2024-05-10T06:00:02Z","modified":"2026-06-17T07:24:32Z","products":[{"vendor":"e4jvikwp","product":"vikbooking hotel booking engine \u0026 pms"},{"vendor":"unknown","product":"vikbooking hotel booking engine \u0026 pms"},{"vendor":"vikwp","product":"vikbooking_hotel_booking_engine_\\\u0026_pms"}],"references":[{"url":"https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2441"},{"url":"https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79"},{"url":"https://github.com/advisories/GHSA-r566-fcmc-4j3v"}],"sources":{"cve":[{"id":"CVE-2024-2441","title":"VikBooking \u003c 1.6.8 - Insecure Direct Object References","description":"The VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.","status":"published","published":"2024-05-10T06:00:02.156Z","modified":"2025-03-14T00:35:04.454Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:09.540667Z"}],"euvd":[{"id":"EUVD-2024-27391","description":"The VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.","status":"published","published":"2024-05-10T06:00:02Z","modified":"2025-03-14T00:35:04Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:03.669796Z"}],"ghsa":[{"id":"GHSA-r566-fcmc-4j3v","title":"The VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8 allows direct access to...","description":"The VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.","status":"published","published":"2024-05-14T15:32:54Z","modified":"2025-03-14T03:32:25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:00:17.214914Z"}],"nvd":[{"id":"CVE-2024-2441","description":"The VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine \u0026 PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.","status":"published","published":"2024-05-14T15:19:20.063Z","modified":"2026-06-17T07:24:32.517Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:09:57.497105Z"}]}}