WP Hotel Booking <= 2.0.7 - SQL Injection
WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admin_init, letting unauthenticated users perform SQL injections, exploit requires no authentication. References: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-hotel-booking/wp-hotel-booking-207-unauthenticated-sql-injection https://nvd.nist.gov/vuln/detail/CVE-2023-5652 Remediation: Update to version 2.0.8 or later.
Used 20 times · 10 assets checked · domain, subdomain, ipv4