Description
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Hotel Booking | < 2.3.2 | 2.3.2 |
References
- https://wpscan.com/vulnerability/0f678ab4-ec62-48a9-88c8-def3228ff725/ exploit vdb-entry technical-description