WP Hotel Booking < 2.0.8 - Unauthenticated SQLi
30Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 64%
exploitation probability
64%top 1% of all CVEs
observed exploitation
nono source reports it
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
Affected products
Unknown · WP Hotel Booking