PT-2026-66393 · WordPress · Wp Hotel Booking
CVSS v3.1
6.8
متوسطة
| المتجه | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
WP Hotel Booking versions prior to 2.3.2
Description
Insufficient sanitization and escaping of a search parameter in an administrative listing allows authenticated users with booking-management roles or higher to perform SQL injection. This occurs because the plugin fails to properly prepare the SQL query, enabling attackers to append additional queries to extract sensitive information from the database.
Recommendations
Update WP Hotel Booking to version 2.3.2 or later.
استغلال
إصلاح
SQL injection
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Wp Hotel Booking