CVE-2023-5991: Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
Vulnerability summary
CVE-2023-5991 is a critical (CVSS 9.8) Path Traversal vulnerability in motopress hotel_booking_lite. EPSS estimates a 3.31% chance of exploitation in the next 30 days, higher than 88.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 4.8.5.
Timeline
- 26-12-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
CVSS metrics
2 scores · 2 sources · 1 version- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.31%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.31% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Motopress1 product
- hotel_booking_lite< 4.8.5
Unknown1 product
- hotel booking lite< 4.8.5
Wordpress1 product
- motopress-hotel-booking-lite< 4.8.5
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/e9d35e36-1e60-4483-b8b3-5cbf08fcd49eExploitVDB EntryTechnical DescriptionThird Party Advisory