Turitop Booking System Vulnerabilities

[en] Deserialization of Untrusted Data vulnerability in turitop TuriTop Booking System allows Object Injection. This issue affects TuriTop Booking System: from n/a through 1.0.10.

Affected:

up to 1.0.10

Fix:

No patched version reported

Disclosed:

Apr 17, 2025

CVE-2025-32571 on NVD →

The TuriTop Booking System plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.0.10 via deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the...

CVSS:

8.8

Affected:

up to 1.0.10

Fix:

No patched version reported

Disclosed:

Apr 14, 2025

CVE-2025-32571 on NVD →

The TuriTop Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.0.17

Fixed in:

1.0.18

Disclosed:

Apr 3, 2025

CVE-2025-31541 on NVD →

[en] Missing Authorization vulnerability in turitop TuriTop Booking System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TuriTop Booking System: from n/a through 1.0.10.

Affected:

up to 1.0.10

Fix:

No patched version reported

Disclosed:

Apr 3, 2025

CVE-2025-31541 on NVD →