CVE-2024-6467: BookingPress WordPress Plugin RCE Vulnerability

CVE-2024-6467 Overview

CVE-2024-6467 affects the BookingPress Appointment Booking Calendar plugin for WordPress in all versions up to and including 1.1.5. The vulnerability resides in the bookingpress_save_lite_wizard_settings_func function, which fails to validate file paths supplied by authenticated users. Attackers holding Subscriber-level access or higher can read arbitrary files on the local server or retrieve content from remote locations, then write that content into attacker-controlled files. This enables execution of arbitrary PHP code and disclosure of sensitive server data such as wp-config.php credentials.

Critical Impact
Authenticated attackers with minimal privileges can chain arbitrary file read with arbitrary file creation to achieve remote code execution on affected WordPress sites.

Affected Products

BookingPress Appointment Booking Calendar Plugin for WordPress versions ≤ 1.1.5
Reputeinfosystems BookingPress (all releases through 1.1.5)
WordPress sites running the vulnerable plugin with open user registration

Discovery Timeline

2024-07-17 - CVE-2024-6467 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6467

Vulnerability Analysis

The flaw is categorized under [CWE-73]: External Control of File Name or Path. The bookingpress_save_lite_wizard_settings_func function accepts user-controlled input that specifies both a source file location and a destination path. The plugin performs the copy operation without sanitizing either parameter or verifying that the caller has administrative rights.

Because the endpoint only requires an authenticated session, any Subscriber can invoke the function. WordPress installations that allow open registration therefore expose the endpoint to any anonymous visitor willing to create an account. The combination of arbitrary read and arbitrary write within a single function elevates what would otherwise be an information disclosure into a full code execution primitive.

Root Cause

The wizard settings handler was designed to save configuration assets but does not enforce capability checks beyond basic authentication. It also lacks path canonicalization and MIME validation, so a PHP payload retrieved from a remote URL can be written directly into the WordPress webroot.

Attack Vector

An attacker registers a Subscriber account, authenticates, and issues a request to the vulnerable AJAX action. The request specifies a remote URL hosting a PHP payload as the source and a destination path such as wp-content/uploads/shell.php. The plugin fetches the remote content and writes it to the target location, which the attacker then loads through the browser to execute code in the context of the web server. The same primitive can extract wp-config.php by pointing the source at the local file and the destination at a web-accessible location.

The vulnerability mechanism is documented in the WordPress BookingPress Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-6467

Indicators of Compromise

Unexpected PHP files appearing under wp-content/uploads/ or plugin directories with recent modification timestamps
HTTP POST requests to admin-ajax.php invoking the bookingpress_save_lite_wizard_settings_func action from Subscriber accounts
Outbound HTTP requests from the WordPress host to unfamiliar domains during BookingPress activity
Copies of wp-config.php or other configuration files present in web-accessible directories

Detection Strategies

Audit WordPress access logs for POST requests to admin-ajax.php containing the bookingpress_save_lite_wizard action parameter
Correlate low-privilege authentication events with subsequent file writes in the webroot
Scan the WordPress filesystem for PHP files outside expected plugin and theme directories
Compare installed plugin file hashes against known-good releases to identify tampered code

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and plugin directories
Alert on new Subscriber account registrations followed by AJAX activity within short time windows
Monitor egress traffic from web servers for unexpected outbound HTTP calls initiated by the PHP process

How to Mitigate CVE-2024-6467

Immediate Actions Required

Update BookingPress Appointment Booking Calendar plugin to a version above 1.1.5 immediately
Review all Subscriber and higher user accounts and remove unrecognized registrations
Inspect wp-content/uploads/ and plugin directories for unauthorized PHP files and remove them
Rotate WordPress database credentials, salts, and API keys if compromise is suspected

Patch Information

The vendor addressed the flaw in the plugin update referenced by WordPress BookingPress Changeset 3116857. The patch adds capability checks and path validation to the bookingpress_save_lite_wizard_settings_func function. Administrators should apply the update through the WordPress plugin manager and verify the installed version reflects the fixed release.

Workarounds

Disable the BookingPress plugin until the patched version is installed
Disable open user registration by setting Anyone can register to off under WordPress General Settings
Restrict access to admin-ajax.php at the web server or WAF layer for the vulnerable action name
Set the WordPress uploads directory to deny PHP execution via web server configuration

bash

# Apache: block PHP execution in the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.ph(p[3457]?|t|tml)$">
        Require all denied
    </FilesMatch>
</Directory>