CVE-2023-1977: Booking Manager < 2.0.29 - Subscriber+ SSRF

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-16 · updated 2026-06-17

Description

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.

Affected products

Booking Manager: before 2.0.29 — fixed in 2.0.29

How to fix

Upgrade to a fixed version: Booking Manager 2.0.29. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/842f3b1f-395a-4ea2-b7df-a36f70e8c790
https://wpscan.com/vulnerability/842f3b1f-395a-4ea2-b7df-a36f70e8c790

Get alerted when CVE-2023-1977 or the next vulnerability affects your stack