CVE-2024-12067

CVE-2024-12067 affects the WordPress plugin pair WP Travel – Ultimate Travel Booking System, Tour Management Engine, with vulnerable versions up to 10.0.0. The vulnerability is an SQL Injection in the wptravel_get_booking_data function caused by insufficient escaping of the booking_itinerary para...

CVE-2024-12067 WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection

The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'bookingitinerary' parameter of the 'wptravelgetbookingdata' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied...