Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2023-5652 - critical 🚨 WP Hotel Booking <= 2.0.7 - SQL Injection > WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lac... 👾 https://cloud.projectdiscovery.io/library/CVE-2023-5652 @pdnuclei #NucleiTemplates #cve
Post summary
CVE-2023-5652 is a critical SQL injection affecting WP Hotel Booking plugin versions up to 2.0.7, with details accessed via a Project Discovery library link.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | thimpress | wp_hotel_booking | - | wordpress | - |