WP Hotel Booking search lets booking staff inject SQL
WP Hotel Booking before 2.3.2 takes the s parameter from the wp-admin hb_booking listing and WPHB_Post_Types::posts_where_paged() concatenates it directly into LIKE clauses for customer email, first name and last name metadata. A user who can access the booking-management screen, including the plugin-defined Booking Editor or Hotel Manager roles, can alter the generated SELECT query and perform SQL injection. The exact extractable data and technique depend on the database and query context, but the primitive can support unauthorized database reads and time-based inference. Version 2.3.2 wraps the search with $wpdb->esc_like() and $wpdb->prepare().
- Component
- WP Hotel Booking
- Plugin slug
wp-hotel-booking- Affected
- < 2.3.2
- Safe version
2.3.2- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
Update WP Hotel Booking to 2.3.2 or later. Review database and web logs for suspicious requests to edit.php?post_type=hb_booking containing SQL syntax in the s parameter, and rotate credentials or secrets if database disclosure is suspected. Limit Booking Editor and Hotel Manager accounts to trusted staff.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N