CVE-2024-3022

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_process_upload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to upload arbitrary files on the affected site's server, enabling remote code execution.

• CWE-434
• CWE-434

• https://plugins.trac.wordpress.org/changeset/3061435/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_fileupload_class.phpPatch
• https://r0ot.notion.site/BookingPress-1-0-84-Authenticated-Administrator-Arbitrary-File-Upload-lead-to-RCE-e2603371c0c14d828144e26f2fdc1d01?pvs=4Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/049ec264-3ed1-4741-937d-8a633ef0a627?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/3061435/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_fileupload_class.phpPatch
• https://r0ot.notion.site/BookingPress-1-0-84-Authenticated-Administrator-Arbitrary-File-Upload-lead-to-RCE-e2603371c0c14d828144e26f2fdc1d01?pvs=4Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/049ec264-3ed1-4741-937d-8a633ef0a627?source=cveThird Party Advisory

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30214The application allows a high privilege attacker to append a…4.8
• CVE-2024-30215The Resource Settings page allows a high privilege attacker …4.8
• CVE-2024-30216Cash Management in SAP S/4 HANA does not perform necessary a…4.3
• CVE-2024-30217Cash Management in SAP S/4 HANA does not perform necessary a…4.3
• CVE-2024-30218The ABAP Application Server of SAP NetWeaver as well as ABAP…6.5
• CVE-2024-30219Active debug code vulnerability exists in PLANEX COMMUNICATI…6.8
• CVE-2024-30220Command injection vulnerability in PLANEX COMMUNICATIONS wir…8.8
• CVE-2024-30221Deserialization of Untrusted Data vulnerability in sunshinep…9.8
• CVE-2024-30222Deserialization of Untrusted Data vulnerability in Repute In…8.8
• CVE-2024-30223Deserialization of Untrusted Data vulnerability in Repute In…9.8
• CVE-2024-30224Deserialization of Untrusted Data vulnerability in Wholesale…9.8
• CVE-2024-30225Deserialization of Untrusted Data vulnerability in WPENGINE,…10