2023-08-16 11:03:28
WPScan
PUBLISHED
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in its admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.