CVE-2024-53800: Rezgo Booking PHP File Inclusion Flaw

CVE-2024-53800 Overview

CVE-2024-53800 is a PHP Local File Inclusion (LFI) vulnerability in the Rezgo Online Booking WordPress plugin. The flaw affects all plugin versions up to and including 4.17. It falls under CWE-98, Improper Control of Filename for Include/Require Statement in a PHP program. Unauthenticated attackers can abuse the vulnerability over the network to include local files through PHP include/require statements. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
An unauthenticated attacker can include arbitrary local files through the vulnerable Rezgo plugin, potentially leading to sensitive data disclosure and remote code execution on the WordPress host.

Affected Products

Rezgo Online Booking WordPress plugin versions up to and including 4.17
WordPress sites running the rezgo:rezgo_online_booking component
Deployments that expose the plugin endpoints to unauthenticated network traffic

Discovery Timeline

2025-01-07 - CVE-2024-53800 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53800

Vulnerability Analysis

The Rezgo Online Booking plugin passes attacker-controlled input into a PHP include or require statement without adequate validation. This behavior maps to [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. The plugin fails to constrain the resolved path to an allowlist of expected template files.

Because the include target is derived from request data, an attacker can traverse directories and load arbitrary files that the PHP process can read. On typical WordPress hosts, this includes wp-config.php, log files, session files, and uploaded content. If an attacker can influence file content on the server, for example through uploads or log poisoning, the LFI can escalate to remote code execution.

The attack requires no authentication and no user interaction. The CVSS attack complexity is rated High because exploitation depends on reaching a vulnerable code path with a resolvable local file.

Root Cause

The root cause is missing or insufficient input sanitization before the plugin composes a filesystem path used in a PHP file inclusion call. The plugin does not enforce a canonical path check, an allowlist, or a fixed base directory prefix before invoking include, require, or their _once variants.

Attack Vector

The attack vector is network based. An attacker sends a crafted HTTP request to a vulnerable Rezgo plugin endpoint on a WordPress site. The request supplies a filename or path parameter that the plugin passes into a PHP include statement, causing the server to load a file chosen by the attacker.

No verified proof-of-concept has been published for this CVE. Consult the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-53800

Indicators of Compromise

HTTP requests to Rezgo plugin endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes
Requests referencing sensitive paths like wp-config.php, /etc/passwd, or PHP session files in query or POST parameters
Unexpected PHP include/require errors in web server logs referencing plugin files under /wp-content/plugins/rezgo/
Outbound connections or new administrative users appearing shortly after suspicious requests to the plugin

Detection Strategies

Inspect web server and WordPress access logs for requests to Rezgo plugin URLs containing filesystem paths or traversal patterns
Deploy Web Application Firewall (WAF) rules that block LFI payloads targeting WordPress plugin endpoints
Correlate suspicious plugin requests with subsequent PHP errors, file reads, or process executions on the host

Monitoring Recommendations

Alert on read access to wp-config.php and other sensitive configuration files by the web server user
Monitor for creation of new PHP files in wp-content/uploads/ or unusual writes under plugin directories
Track WordPress plugin inventory to identify installations of Rezgo Online Booking at version 4.17 or earlier

How to Mitigate CVE-2024-53800

Immediate Actions Required

Update the Rezgo Online Booking plugin to a version released after 4.17 that addresses CVE-2024-53800
If no fixed version is available for your installation, deactivate and remove the plugin until a patch is applied
Review web server access logs for signs of prior exploitation targeting the plugin
Rotate WordPress secrets in wp-config.php and database credentials if LFI activity is suspected

Patch Information

Refer to the Patchstack Vulnerability Report for vendor-supplied patch details and the fixed release version. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched build.

Workarounds

Restrict access to Rezgo plugin URLs at the WAF or reverse proxy layer until the plugin is updated
Enforce PHP open_basedir restrictions to limit file inclusion to the WordPress document root
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to reduce inclusion attack surface
Run the PHP process as a low-privilege user with read access limited to required WordPress directories

bash

# Configuration example: harden php.ini against file inclusion abuse
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"