Authenticated code execution via unrestricted logo import

Arbitrary file creation in Repute InfoSystems BookingPress 1.1.5 and earlier allows remote authenticated users to execute PHP code. The bookingpress_save_lite_wizard_settings_func path passes an attacker-controlled logo URL and basename-derived filename to bookingpress_upload_file_func, which reads the URL with file_get_contents and writes the bytes beneath the uploads directory without restricting content or extension. Subscriber-level access and a valid nonce are sufficient; a PHP payload can execute as server-side code, while local or remote resources can also be copied to expose secrets.