CVE-2023-5652

CRITICAL NUCLEI

Thimpress WP Hotel Booking < 2.0.8 - SQL Injection

Title source: rule

Description

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections

Nuclei Templates (1)

WP Hotel Booking <= 2.0.7 - SQL Injection

CRITICALVERIFIEDby Shivam Kamboj

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/8ea46b9a-5239-476b-949d-49546371eac1

Scores

CVSS v3 9.8

EPSS 0.7141

EPSS Percentile 98.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

thimpress/wp_hotel_booking < 2.0.8

Published Nov 20, 2023

Tracked Since Feb 18, 2026