CVE-2024-11641: 
WordPress vulnerability analysis and mitigation

The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.7.2. This vulnerability was discovered and reported in January 2024 (Wordfence).

The vulnerability stems from missing or incorrect nonce validation on the 'save' function. The issue has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high-severity vulnerability that requires user interaction but no privileges for exploitation (NVD).

Successful exploitation of this vulnerability allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server, potentially enabling remote code execution. Additionally, unauthenticated attackers can change plugin access privileges if they can trick a site administrator into performing specific actions (NVD).

A patch has been released to address this vulnerability. Users are advised to update their VikBooking Hotel Booking Engine & PMS plugin to version 1.7.3 or later (WordPress).