CVE-2024-1382: 
WordPress vulnerability analysis and mitigation

The Restaurant Reservations plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-1382) affecting all versions up to and including 1.9. The vulnerability exists in the nd_rst_layout attribute of the nd_rst_search shortcode. This security issue was disclosed on March 7, 2024, and received a CVSS v3.1 base score of 8.8 (High) (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to include and execute arbitrary PHP files on the server through the nd_rst_layout attribute of the nd_rst_search shortcode. The issue stems from improper input validation, enabling attackers to execute any PHP code contained within the included files (NVD).

The exploitation of this vulnerability can lead to serious security breaches including bypass of access controls, unauthorized access to sensitive data, and potential code execution in cases where uploaded PHP files may not be directly accessible (NVD).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) with no user interaction (UI:N) (NVD).

Users should update to version 2.0 or later of the Restaurant Reservations plugin to address this vulnerability. The fix has been implemented in the WordPress plugin repository (WordPress Plugin).