CVE-2024-7855 is an arbitrary file upload vulnerability in the WP Hotel Booking WordPress plugin by thimpress. The issue arises from the lack of file type validation in the update_review() function, allowing authenticated users with subscriber-level privileges or higher to upload potentially dangerous files. This vulnerability affects all versions up to 2.1.2 and could enable remote code execution if exploited. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the low subscriber level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with subscriber-level access or higher can upload arbitrary files to the server hosting the vulnerable WP Hotel Booking plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) indicates a serious risk if exploited. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — no official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and consider restricting subscriber-level access or disabling the affected functionality until a fix is released. Avoid granting unnecessary privileges to users and review uploaded files carefully. Do not rely on generic mitigations unrelated to this specific vulnerability.