Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Boat Rental Plugin for WordPress lets attackers upload web shell

CVE-2024-52376 · published 1 year ago
Summary

The Boat Rental plugin for WordPress (versions up to 1.0.1) allows anyone to upload files of any type, including malicious scripts. An attacker could place a hidden program on your web server that gives them control of your site. Update the plugin to a patched version or remove it until a safe update is available, and restrict file uploads to trusted formats only.

Original advisory text
Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a Web Server.This issue affects Boat Renta...
Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a Web Server.This issue affects Boat Rental Plugin for WordPress: from n/a through <= 1.0.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published14 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-52376 · NVD
Track software like this
Free during beta