Not rated
CVE-2023-5652 The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not…
Description
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Hotel Booking 2.0 | earliest → < 2.0.8 | 2.0.8 |
Other CVEs of WP Hotel Booking
The 8 CVEs of WP Hotel Booking →
CVE-2026-15149
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total…
5.3
Medium
CVE-2026-15152
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a…
5.3
Medium
CVE-2026-15153
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an…
6.8
Medium
CVE-2026-9822
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers,…
6.5
Medium