Aug. 16, 2023, 12:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.

admin attacks booking cve events file ics input internal internal network low manager network panel plugin privileges ssrf urls wordpress wordpress plugin

SAP Security Administrator

@ FARO Technologies | Americas-US-Lake Mary-125 Bldg

Cloud Security Engineer, Specialist

@ Vanguard | Malvern, PA

Cybersecurity Assessment and Authorization Specialist

@ Booz Allen Hamilton | USA, MD, Bethesda (9000 Rockville Pike)

Network Security Specialist

@ IAG GBS | Madrid, Spain

Information System Security Officer

@ CSEngineering | Nellis Air Force Base, NV, USA

Senior Consultant, Risk and Governance

@ CIBC | Toronto-CC East 11th Floor