CVE-2024-3605

🗓️ 20 Jun 2024 02:15:10Reported by [email protected]Type

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for SQL Injection in Thimpress Wp_Hotel_Booking	12 Jan 202507:53	–	githubexploit
Circl	CVE-2024-3605	14 Jan 202512:49	–	circl
CNNVD	WordPress plugin WP Hotel Booking security vulnerability	20 Jun 202400:00	–	cnnvd
CVE	CVE-2024-3605	20 Jun 202402:08	–	cve
Cvelist	CVE-2024-3605 WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection	20 Jun 202402:08	–	cvelist
Nuclei	WP Hotel Booking <= 2.1.0 - SQL Injection	13 Apr 202604:19	–	nuclei
OSV	CVE-2024-3605	20 Jun 202402:15	–	osv
Patchstack	WordPress WP Hotel Booking plugin <= 2.1.0 - Unauthenticated SQL Injection vulnerability	19 Jun 202412:46	–	patchstack
Patchstack	WordPress WP Hotel Booking Plugin <= 2.1.0 is vulnerable to SQL Injection	19 Jun 202400:00	–	patchstack
Positive Technologies	PT-2024-26863	20 Jun 202400:00	–	ptsecurity

NVD

Node

thimpress wp_hotel_bookingRange≤2.1.0wordpress

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5931ad4e-7de3-41ac-b783-f7e58aaef569
wordpress	www.wordpress.org/plugins/wp-hotel-booking/

08 Apr 2026 18:21Current

CVSS 3.19.8 - 10

EPSS0.78976

CWE-89