Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: WP Hotel Booking 2.0.8 Clear all filters
TI-2023-05198 CVE-2023-5651 · GHSA-f9vh-fjmh-q969

WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion

Priority MEDIUM 58

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00271 Published 2023-11-20 Fixed in 2.0.8 CWE-732
TI-2023-05335 CVE-2023-5799 · GHSA-r4pf-qg69-h279

WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion

Priority LOW 25

The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0052 Published 2023-11-20 Fixed in 2.0.8 CWE-863
TI-2023-05199 CVE-2023-5652 · GHSA-6vrh-99q9-hcxv

WP Hotel Booking < 2.0.8 - Unauthenticated SQLi

Priority HIGH 78

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauth…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.63711 Published 2023-11-20 Fixed in 2.0.8 CWE-89