CVE-2024-3022 affects the BookingPress plugin for WordPress, specifically in the 'bookingpress_process_upload' function. The vulnerability arises from insufficient validation of uploaded filenames, permitting authenticated users with administrator privileges to upload arbitrary files. This can enable remote code execution on the server hosting the plugin. The issue impacts all versions up to and including 1.0.87. The CVSS 3.1 base score is 7.2 (High), with network attack vector, low attack complexity, high privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

An attacker with administrator-level access can exploit this vulnerability to upload malicious files, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the high CVSS score and the nature of the vulnerability, successful exploitation could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious file uploads. Avoid using affected versions of the BookingPress plugin where possible.