title: Booking Manager < 2.0.29 - Subscriber+ SSRF
description: The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
vendor: Unknown
product: Booking Manager
versions:
status: affected, versionType: custom, version: 0, lessThan: 2.0.29
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}