Executive brief
Dharma Booking is a WordPress plugin used for managing accommodation reservations. A security flaw in this plugin allows unauthorized individuals to access sensitive files on the web server, such as system configuration files or database credentials. This could lead to a full compromise of the website and the exposure of private customer data.
Technical details
A local file inclusion (LFI) vulnerability exists in the Dharma Booking plugin for WordPress due to improper validation of the 'gateway' GET parameter in the 'proccess.php' file. Specifically, the code uses a require_once() statement on the user-supplied parameter without sanitization, allowing for directory traversal (e.g., ../../../) and null byte injection (%00) to bypass file extension appending. An unauthenticated attacker can exploit this to read sensitive local files such as 'wp-config.php' or '/etc/passwd'. The plugin has been closed on the WordPress repository since 2015 and is no longer maintained; users are advised to uninstall it.
Affected products
- Jamie Dharma Booking <= 2.28.3
Timeline
- 2015-03-08: other: Plugin closed on WordPress.org repository
- 2016-03-22: disclosed: Exploit-DB entry published
- 2026-06-15: advisory: CVE published and NVD record created