CVE-2023-5652: WP Hotel Booking < 2.0.8 - Unauthenticated SQLi
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admininit, allowing unauthenticated users to perform SQL injections
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5652?
The severity of CVE-2023-5652 is critical.
What is the vulnerability in WP Hotel Booking < 2.0.8?
The vulnerability in WP Hotel Booking < 2.0.8 is an unauthenticated SQL injection (SQLi).
How does the vulnerability in WP Hotel Booking < 2.0.8 allow unauthenticated users to perform SQL injections?
The vulnerability in WP Hotel Booking < 2.0.8 allows unauthenticated users to perform SQL injections due to the lack of authorization and Cross-Site Request Forgery (CSRF) checks, as well as the failure to escape user input in a SQL statement.
What is the affected software version of the WP Hotel Booking plugin?
The affected software version of the WP Hotel Booking plugin is up to and excluding 2.0.8.
Is there a fix available for CVE-2023-5652?
Yes, updating WP Hotel Booking to version 2.0.8 or later will fix CVE-2023-5652.