The vulnerability identified as CVE-2024-51582 affects the WP Hotel Booking plugin by ThimPress, specifically versions up to and including 2.2.9. It involves a path traversal flaw using the '.../...//' sequence, which leads to PHP local file inclusion. This allows an attacker to potentially read or execute arbitrary files on the server. The attack vector is network-based, requiring low privileges and no user interaction, but with high complexity due to the need for a specific path traversal technique. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to disclose sensitive information, execute arbitrary code, or cause denial of service. The CVSS score of 7.5 reflects a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Until a patch is available, users should consider disabling the affected plugin or restricting access to it to trusted users only. Monitor the vendor's communications for updates and apply official fixes promptly once released.