Skip to content
Sign in
9.8 Critical

CVE-2024-4413 The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…

Description

The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Affected products and versions

Product Affected versions Fixed in
Hotel Booking Lite 4.11 earliest → 4.11.1 No fix stated
hotel_booking_lite 4.11 earliest → 4.11.1 No fix stated
MotoPress Hotel Booking 4.11 earliest → 4.11.1 No fix stated

Other CVEs of Hotel Booking Lite

The 3 CVEs of Hotel Booking Lite →
CVE-2026-57347 Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions 6.5 Medium CVE-2025-66078 Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite… 9.1 Critical
Track this CVE