WP Hotel Booking vulnerabilities
3 known vulnerabilities in WP Hotel Booking from ThimPress. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
WP Hotel Booking: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: from n/a through <= 2.2.9.
- 8.8 High severity
WP Hotel Booking: Unrestricted Upload of File with Dangerous Type
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscrib
- 9.8 Critical severity
WP Hotel Booking: Improper Neutralization of Special Elements used in an SQL Command
The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter