CVE-2023-5652: WP Hotel Booking < 2.0.8 - Unauthenticated SQLi
First published: Mon Nov 20 2023(Updated: )
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Thimpress Wp Hotel Booking | <2.0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-5652?
The severity of CVE-2023-5652 is critical.
What is the vulnerability in WP Hotel Booking < 2.0.8?
The vulnerability in WP Hotel Booking < 2.0.8 is an unauthenticated SQL injection (SQLi).
How does the vulnerability in WP Hotel Booking < 2.0.8 allow unauthenticated users to perform SQL injections?
The vulnerability in WP Hotel Booking < 2.0.8 allows unauthenticated users to perform SQL injections due to the lack of authorization and Cross-Site Request Forgery (CSRF) checks, as well as the failure to escape user input in a SQL statement.
What is the affected software version of the WP Hotel Booking plugin?
The affected software version of the WP Hotel Booking plugin is up to and excluding 2.0.8.
Is there a fix available for CVE-2023-5652?
Yes, updating WP Hotel Booking to version 2.0.8 or later will fix CVE-2023-5652.
- collector/nvd-api
- agent/weakness
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/description
- collector/epss-latest
- source/FIRST
- agent/references
- agent/severity
- agent/title
- agent/author
- agent/epss
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/thimpress
- canonical/thimpress wp hotel booking