On August 3rd, 2024, Wordfence received a submission for an Arbitrary File Upload vulnerability in WP Hotel Booking, a WordPress plugin with more than 8,000 active installations. This vulnerability can be used by authenticated attackers, with subscriber-level access and above, to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover.

Props to Truoc Phan who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $488.00 for this discovery.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on August 15, 2024. Sites using the free version of Wordfence received the same protection 30 days later on September 14, 2024.

Wordfence contacted the ThimPress team via their contact form on August 15, 2024, but we didn’t get a response. After receiving no response, we tried reaching out to them via email on September 10, 2024, and received a response on the same day. After providing full disclosure details, the developer released the patch on September 26, 2024. We would like to commend the ThimPress team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of WP Hotel Booking, version 2.1.3 at the time of this publication, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2024/10/8000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-wp-hotel-booking-wordpress-plugin