PT-2023-16515 · WordPress · Avirato Hotels Online Booking Engine
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Avirato hotels online booking engine WordPress plugin versions 5.0.5 and earlier
Description
The issue concerns a lack of validation and escaping of certain shortcode attributes, which are then used in SQL statements. This could allow authenticated users, such as subscribers, to perform SQL Injection attacks.
Recommendations
For Avirato hotels online booking engine WordPress plugin versions 5.0.5 and earlier, update to a version later than 5.0.5 to resolve the issue.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Avirato Hotels Online Booking Engine