WP Hotel Booking

WP Hotel Booking before 2.3.2 can mark a booking fully paid after receiving a payment notification without confirming that the payment went to the site's configured merchant account or that its amount matches the booking total. An unauthenticated attacker can present a notification for a payment that does not compensate the site owner and obtain paid-booking status. The payment provider, notification endpoint or action, request parameters, handler function and merchant and amount fields are not disclosed.

WP Hotel Booking before 2.3.3 relies on cart values supplied by an unauthenticated buyer and does not require room quantities or the resulting order total to be non-negative. By submitting manipulated cart data, an attacker can offset legitimate charges and create a confirmed reservation for free or below the configured room price. The booking endpoint or action, parameter names, cart parser, total-calculation and confirmation functions and accepted value ranges are not disclosed.

WP Hotel Booking before 2.3.2 takes the s parameter from the wp-admin hb_booking listing and WPHB_Post_Types::posts_where_paged() concatenates it directly into LIKE clauses for customer email, first name and last name metadata. A user who can access the booking-management screen, including the plugin-defined Booking Editor or Hotel Manager roles, can alter the generated SELECT query and perform SQL injection. The exact extractable data and technique depend on the database and query context, but the primitive can support unauthorized database reads and time-based inference. Version 2.3.2 wraps the search with $wpdb->esc_like() and $wpdb->prepare().

WP Hotel Booking through 2.3.2 lets a Contributor store an attacker-controlled widget_search attribute in the hotel_booking shortcode. WPHB_Shortcode_Hotel_Booking::add_shortcode() passes the attribute into the search template, which writes it unescaped into the hidden widget-search input's value attribute. The payload requires a browser and access-key combination that activates the hidden control, but can then execute in a visitor's session.

WP Hotel Booking 2.3.2 and earlier places the check_in_date request value back into rendered output without adequate sanitization and escaping. A remote attacker can prepare a link whose date value contains script; the code runs only when a victim opens the link, but it runs in the affected site's origin and can act with that visitor's browser permissions.

WP Hotel Booking is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.3.1.

WP Hotel Booking is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.3.1.

WP Hotel Booking is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 2.3.1.

WP Hotel Booking is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.

WP Hotel Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Hotel Booking is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

WP Hotel Booking is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Hotel Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Hotel Booking is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

WP Hotel Booking is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Hotel Booking is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Hotel Booking is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

WP Hotel Booking is affected by dangerous file upload. Exploitation requires an authenticated subscriber account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

WP Hotel Booking is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

WP Hotel Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Hotel Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Hotel Booking is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

WP Hotel Booking is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

WP Hotel Booking is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Wp Hotel Booking is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Wp Hotel Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.