Vulnerability · Published Nov 20, 2023 · Assigned by WPScan

CVE-2023-5652WP Hotel Booking < 2.0.8 - Unauthenticated SQLi

Critical 9.8

In plain English

A critical-severity security flaw in WP Hotel Booking from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 63.7% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)63.7%top 0.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Hotel Booking	0 – before 2.0.8

References

https://wpscan.com/vulnerability/8ea46b9a-5239-476b-949d-49546371eac1 exploit, vdb-entry, technical-description