CVE-2024-3022 is a High severity (CVSS 7.2) arbitrary file upload flaw in the BookingPress appointment booking plugin for WordPress, affecting all versions up to and including 1.0.87. It requires administrator level access. The fix is to update to a release newer than 1.0.87 and confirm the version against the vendor changelog.
What's affected
The record lists the BookingPress plugin for WordPress, in all versions up to and including 1.0.87. The weakness is tracked as CWE-434, unrestricted upload of a file with a dangerous type. It sits in the bookingpress_process_upload function, which does not validate filenames well enough.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. That means the attack runs over the network, needs no user interaction, and requires high privileges. The impact on confidentiality, integrity and availability is rated high, because an uploaded file can lead to remote code execution on the web server.
The record does not name a fixed version. It references a WordPress plugin repository changeset (3061435) that touches the file upload class, and a Wordfence vulnerability entry. I could not retrieve the Wordfence page to read its fixed version, so check the plugin changelog and the Wordfence entry before you rely on a specific number. Anything newer than 1.0.87 is the starting point to look for.
How to check if you're exposed
If you use WP-CLI on the server, list the plugin and its version:
wp plugin list --name=bookingpress-appointment-booking --fields=name,status,version
Without shell access, open Plugins in the WordPress dashboard and read the version under BookingPress. If it is 1.0.87 or lower, you are in the affected range.
Next, look at who holds administrator accounts. The flaw needs administrator capabilities, so a site with one trusted admin and strong authentication carries less risk than a site with many admins or reused passwords. Also review the uploads directory for files you do not recognize, especially anything with a script extension.
What to do now
- Update BookingPress to the latest release and confirm it is newer than 1.0.87.
- Review the list of administrator accounts and remove any you do not need.
- Turn on multi-factor authentication for every administrator login.
- Check the WordPress uploads directory and plugin folders for unexpected files, and compare against a known good backup if you have one.
- If the plugin cannot be updated right away, deactivate it until it can be.
Why it matters
Unrestricted file upload is a classic way to turn a limited foothold into code execution. If the server accepts a file whose type is not checked properly, and the web server then executes it, the person who uploaded it controls the host. The record frames this as an authenticated issue, which lowers the odds of random internet abuse but does not remove the risk from stolen or phished admin credentials.
The record does not list this CVE as exploited in the wild, and CISA has not flagged it in its Known Exploited Vulnerabilities catalog as far as the record shows. Treat it as a patch-soon item for any WordPress site that books appointments, since those sites often hold customer contact details.
The Gold page for CVE-2024-3022 tracks the entry, and the free in-browser dependency scan at gold.safeguard.sh/scan can help you spot vulnerable components in your own code. Plugins on a live WordPress site are best checked from the dashboard or WP-CLI as shown above.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to worry if only I have an admin account?
The flaw needs administrator capabilities, so risk is lower with a single well protected admin. Still update, because a stolen admin session or password is enough to reach the upload function.
Is there a confirmed fixed version?
The record only says versions up to and including 1.0.87 are affected. Check the plugin changelog or the Wordfence entry for the exact release that fixes it.
Sources
Last reviewed: 19 October 2026.
