CVE-2024-2441: 
WordPress vulnerability analysis and mitigation

The VikBooking Hotel Booking Engine & PMS WordPress plugin before version 1.6.8 contains an Insecure Direct Object References (IDOR) vulnerability. The vulnerability allows authenticated users with subscriber privileges or above to bypass authorization and access plugin settings that they shouldn't be allowed to access. This vulnerability was discovered and reported on April 19, 2024 (WPScan).

The vulnerability is classified as an Insecure Direct Object References (IDOR) issue and falls under the OWASP Top 10 category A5: Broken Access Control. It has been assigned a CVSS score of 3.5 (low severity). The vulnerability is tracked as CWE-639. The issue stems from the plugin allowing direct access to menus without proper authorization checks (WPScan).

When exploited, this vulnerability allows authenticated users with subscriber-level privileges or higher to access unauthorized settings within the VikBooking Hotel Booking Engine & PMS WordPress plugin. This could potentially lead to unauthorized configuration changes and access to sensitive plugin settings (WPScan).

The vulnerability can be exploited by accessing specific URLs directly, such as '/wp-admin/admin.php?option=com_vikbooking&task=config' and '/wp-admin/admin.php?option=com_vikbooking&task=orders'. An attacker needs to have at least subscriber-level authentication to exploit this vulnerability (WPScan).

The vulnerability has been fixed in version 1.6.8 of the VikBooking Hotel Booking Engine & PMS WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).