CVE-2022-1952

published 2022-07-11

CVE-2022-1952: The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to…

Priority P1 87 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
syntacticsinc	easync	< 1.1.16	1.1.16

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php?action=easync_success_and_save

path /wp-content/uploads/{{filename}}.php

• → The vulnerable AJAX action 'easync_success_and_save' is accessible to unauthenticated users. Monitor for unauthenticated GET/POST requests to /wp-admin/admin-ajax.php with the query parameter action=easync_success_and_save. ↗
• → The plugin defines an allowlist of valid file extensions but does NOT apply it during validation, allowing arbitrary file types (e.g., .php) to be uploaded. Detection should flag any non-image/non-allowed extension uploaded via this plugin's AJAX handler. ↗
• → Successful exploitation results in remote code execution via the uploaded PHP file. Correlate a request to admin-ajax.php?action=easync_success_and_save followed by a request to /wp-content/uploads/*.php as an indicator of full compromise. ↗

• · The exploit targets the Free Booking Plugin for Hotels, Restaurant and Car Rental (eaSYNC Booking) versions before 1.1.16. Ensure detections are scoped to WordPress instances running this plugin. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434