CVE-2024-7855: WP Hotel Booking RCE Vulnerability

CVE-2024-7855 Overview

The WP Hotel Booking plugin for WordPress contains an arbitrary file upload vulnerability in the update_review() function. The flaw affects all versions up to and including 2.1.2. The plugin fails to validate file types when authenticated users submit reviews. Attackers with subscriber-level access or higher can upload arbitrary files to the affected server. Successful exploitation may lead to remote code execution on the target host. The vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers with minimal privileges can upload executable files and achieve remote code execution on affected WordPress sites.

Affected Products

Thimpress WP Hotel Booking plugin for WordPress (all versions ≤ 2.1.2)
WordPress sites running the vulnerable wp-hotel-booking plugin
Any deployment allowing subscriber-level user registration with the plugin installed

Discovery Timeline

2024-10-02 - CVE-2024-7855 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7855

Vulnerability Analysis

The vulnerability resides in the update_review() function within includes/class-wphb-comments.php of the WP Hotel Booking plugin. This function handles review submissions and accepts file attachments. The implementation does not validate the MIME type, extension, or content of uploaded files. As a result, authenticated users can submit files with executable extensions such as .php alongside their reviews. Once written to a web-accessible directory, these files can be requested directly to trigger server-side execution.

The EPSS score of 17.128% (96.79 percentile) reflects meaningful real-world exploitation likelihood for this class of WordPress plugin flaw. The plugin serves hotel and reservation websites, expanding the attack surface across hospitality-sector deployments.

Root Cause

The root cause is missing file type validation in the update_review() function. WordPress provides helper functions such as wp_check_filetype() and wp_handle_upload() with allowlist enforcement, but the vulnerable code path bypasses these safeguards. No extension allowlist, MIME sniffing, or content inspection is performed before the file is written to disk.

Attack Vector

An attacker registers or authenticates as a subscriber-level user on the target WordPress site. The attacker then submits a review through the vulnerable endpoint with a malicious PHP payload attached. Because the plugin writes the file without validating its type, the payload lands in an accessible uploads directory. The attacker requests the uploaded file over HTTP, causing the web server to execute the embedded code with the privileges of the PHP process.

See the WordPress Plugin Code Reference and Wordfence Vulnerability Analysis for technical details.

Detection Methods for CVE-2024-7855

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present in the wp-content/uploads/ directory tree, particularly under hotel booking or review-related subdirectories
Web server access logs showing POST requests to review submission endpoints followed by GET requests to newly created files with executable extensions
New or modified subscriber-level user accounts created shortly before suspicious file uploads
Outbound network connections from the PHP process to unfamiliar hosts following review submissions

Detection Strategies

Inventory WordPress installations to identify sites running wp-hotel-booking at version 2.1.2 or earlier
Monitor file creation events in web-accessible upload directories for files with server-executable extensions
Correlate authenticated review-submission requests with subsequent direct file access requests to the uploads path

Monitoring Recommendations

Enable WordPress audit logging to capture review submissions, file uploads, and user role changes
Deploy a web application firewall (WAF) rule blocking uploads with double extensions or executable MIME types to review endpoints
Alert on any process spawned by the web server user that is unusual for a WordPress workload, such as shells, curl, or wget invocations

How to Mitigate CVE-2024-7855

Immediate Actions Required

Update the WP Hotel Booking plugin to a version later than 2.1.2 as soon as the vendor publishes a patched release
Audit wp-content/uploads/ for unauthorized files with executable extensions and remove any confirmed malicious artifacts
Review recently created subscriber accounts and revoke access for accounts that submitted suspicious reviews
Rotate WordPress administrator credentials and secret keys if compromise is suspected

Patch Information

The vendor published a code change in the WordPress plugin repository. Review the WordPress Plugin Changeset for the specific commit addressing the missing file type validation in update_review(). Administrators should update to the latest available version of the plugin through the WordPress admin console.

Workarounds

Disable the WP Hotel Booking plugin until a patched version is installed if updates cannot be applied immediately
Disable open user registration or restrict registration to trusted email domains to reduce the pool of authenticated attackers
Configure the web server to deny PHP execution within wp-content/uploads/ using an .htaccess directive or equivalent Nginx location block
Deploy a WAF ruleset that blocks file uploads with executable extensions to WordPress comment and review endpoints

bash

# Apache: prevent PHP execution in the uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (in server block)
# location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
#     deny all;
#     return 403;
# }