CVE-2023-5991

Motopress Hotel Booking Lite vulnerability

9.8 CRITICALEPSS 3.31%

Published26 Dec 2023

Description

The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Motopress Hotel Booking Lite< 4.8.5

Remediation

Fixed in

Motopress Hotel Booking Lite≥ 4.8.5

Frequently asked

Is CVE-2023-5991 being actively exploited?

CVE-2023-5991 is not in the CISA KEV catalog. Its EPSS exploit probability is 3.31%.

How severe is CVE-2023-5991?

CVE-2023-5991 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 3.31% probability of exploitation.

Which products are affected by CVE-2023-5991?

Affected products include Motopress Hotel Booking Lite.

How do I fix CVE-2023-5991?

Upgrade affected software to a fixed version, for example Motopress Hotel Booking Lite 4.8.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-5991 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.