BookingPress Plugin CVE-2024-3022

Attacker must already possess WordPress administrator-level capabilities or higher (PR:H) on a site running BookingPress free edition version 1.0.87 or earlier, and the BookingPress plugin must be installed and active so its 'bookingpress_process_upload' handler is reachable. No user interaction is required (UI:N) and the endpoint is network-reachable (AV:N), but the high-privilege prerequisite limits exploitation to scenarios where admin credentials have been obtained or where a hostile admin already exists (e.g., multi-author sites, compromised accounts, or managed-hosting tenants with elevated access). The PHP execution context of the uploaded file also depends on the web server permitting script execution in the upload destination - a hardened configuration that denies PHP in writable directories will blunt the RCE impact.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High) - network-reachable, low complexity, no user interaction, full CIA impact, but requiring high privileges (administrator). EPSS at 8.31% (92nd percentile) is notably elevated for a privilege-gated bug and aligns with the publicly available exploit code, suggesting opportunistic scanning of sites where attackers have already obtained admin credentials via phishing, credential stuffing, or compromised accounts. The vulnerability is not listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation at scale; the realistic risk profile is post-compromise privilege amplification (turning admin access into full server RCE) rather than a pre-auth mass-exploit scenario. Prioritization should be elevated for multi-tenant or managed WordPress environments where administrator accounts are not equivalent to full server compromise.

An attacker who has obtained WordPress administrator credentials - via phishing, password reuse, or compromise of a separate admin account - authenticates to the target site and invokes the bookingpress_process_upload endpoint to upload a PHP webshell disguised with a permissive filename. The attacker then accesses the uploaded file directly via its URL to execute arbitrary commands as the web server user, pivoting from WordPress admin to full server control. Publicly available exploit code lowers the bar for this post-compromise step.