Vulnerability record · CVE-2023-5652 · published 20 November 2023
CVE-2023-5652: WP Hotel Booking plugin SQL injection via unauthenticated admin_init hook
Thimpress · Wp Hotel Booking
The WP Hotel Booking WordPress plugin before 2.0.8 lacks authorization and CSRF checks and fails to escape user input before using it in a SQL statement within a function hooked to admin_init. This allows unauthenticated attackers to perform SQL injection. The flaw is critical because it is remotely reachable without credentials and can compromise the database.
Description
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS score is 9.8 (critical) with unauthenticated remote SQL injection, high EPSS, and public exploit availability, making immediate patching essential.
What it is
The WP Hotel Booking WordPress plugin before 2.0.8 lacks authorization and CSRF checks and fails to escape user input before using it in a SQL statement within a function hooked to admin_init. This allows unauthenticated attackers to perform SQL injection. The flaw is critical because it is remotely reachable without credentials and can compromise the database.
Impact
An attacker can read, modify, or delete arbitrary data in the WordPress database, potentially leading to full site compromise or data theft. With high confidentiality, integrity, and availability impact, the attacker gains broad control over the application's data.
Attack surface
The vulnerability is reached over the network via the admin_init hook, which runs on admin-area requests; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
No CISA KEV listing, but EPSS probability is 0.63711 (99.181 percentile) and references include an 'Exploit' tag, indicating public exploit code is available and exploitation is likely.
What to do
- Update WP Hotel Booking plugin to version 2.0.8 or later immediately.
- If patching is not possible, disable or remove the plugin until an update can be applied.
- Deploy a web application firewall (WAF) rule to block SQL injection attempts targeting admin_init or the plugin's endpoints.
- Restrict access to wp-admin and admin-ajax.php where feasible, though the vulnerability is unauthenticated.
- Audit the database and logs for signs of compromise or unauthorized data access.
Detection
- Monitor web server and WAF logs for SQL injection patterns in requests to admin_init or plugin-specific parameters.
- Review database logs for anomalous queries or unexpected data changes.
- Use WordPress security plugins to scan for known vulnerabilities and suspicious activity.
- Check for unexpected administrative users or changes to site content that could indicate post-exploitation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://wpscan.com/vulnerability/8ea46b9a-5239-476b-949d-49546371eac1 | ExploitThird Party Advisory |
| https://wpscan.com/vulnerability/8ea46b9a-5239-476b-949d-49546371eac1 | ExploitThird Party Advisory |
Track CVE-2023-5652 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-5652), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
