CVE-2024-3605

The vulnerability in the WP Hotel Booking plugin for WordPress stems from a critical SQL Injection flaw that affects the '/wphb/v1/rooms/search-rooms' REST API endpoint. This issue arises from inadequate escaping of the 'room_type' parameter, allowing attackers to manipulate SQL queries executed by the application. When user input is not properly sanitized, it opens the door for unauthorized SQL commands to be appended to legitimate queries. This exploitation can lead to unauthorized access to sensitive data stored in the database, including user credentials, payment information, and other confidential records.

Attackers can exploit this vulnerability through various vectors, primarily by sending crafted requests to the vulnerable endpoint. An unauthenticated user can easily manipulate the 'room_type' parameter in the API request to inject malicious SQL code. For instance, an attacker might append a UNION SELECT statement to retrieve data from other tables within the database. This type of attack can be executed remotely, making it particularly dangerous, as it does not require prior authentication or access to the system. The ease of exploitation, combined with the potential for significant data exposure, underscores the severity of this vulnerability.

The real-world impact of this SQL Injection flaw can be profound, especially for businesses relying on the WP Hotel Booking plugin for their operations. Successful exploitation can lead to data breaches, resulting in the exposure of sensitive customer information and potentially damaging the organization's reputation. Furthermore, the financial implications can be severe, including regulatory fines for non-compliance with data protection laws, loss of customer trust, and the costs associated with incident response and remediation efforts. The high CVSS score of 9.8 reflects the critical nature of this vulnerability, indicating that organizations must prioritize its resolution to mitigate associated risks.

To detect and mitigate the risks posed by this vulnerability, organizations should implement a multi-faceted approach. Regular security audits and vulnerability assessments can help identify and address weaknesses in the application. Employing Web Application Firewalls (WAFs) can provide an additional layer of defense by filtering out malicious requests before they reach the application. Additionally, developers should ensure that all user inputs are properly sanitized and validated, using prepared statements or parameterized queries to prevent SQL Injection attacks. Updating the WP Hotel Booking plugin to the latest version, where this vulnerability is patched, is crucial for maintaining a secure environment.

In conclusion, the SQL Injection vulnerability in the WP Hotel Booking plugin represents a significant threat to organizations utilizing this software. The potential for unauthorized data access, coupled with the ease of exploitation, necessitates immediate attention from security professionals. By adopting proactive detection and mitigation strategies, organizations can safeguard their data and maintain the trust of their customers, ultimately reducing the risk of financial and reputational damage.

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting the CVE-2024-3605 vulnerability in the WP Hotel Booking plugin. This increase in activity coincides with the emergence of new proof-of-concept exploits publicly available on GitHub, which have lowered the barrier for unauthenticated attackers to leverage the SQL injection flaw. Our telemetry indicates that while the EPSS score has slightly declined, the CVSS score has been adjusted to the maximum severity of 10.0, reflecting the critical nature and ease of exploitation of this vulnerability. The convergence of heightened detection activity and accessible exploit code significantly elevates the threat landscape, underscoring an urgent need for defenders to prioritize monitoring and response efforts. Consequently, the risk level associated with CVE-2024-3605 has intensified, as adversaries can now more readily extract sensitive data from vulnerable installations, increasing the potential for widespread data breaches and operational disruption.

Update 2 — May 21, 2026

Recent telemetry from CSURFACE threat intelligence indicates a significant reduction in exploitation attempts targeting CVE-2024-3605, despite the vulnerability’s critical severity. This decline in detection activity suggests that adversaries may be deprioritizing this vector or shifting focus to alternative attack surfaces. Concurrently, the CVSS score has been revised downward from 10.0 to 9.8, reflecting a more precise assessment of exploitability and impact based on emerging evidence. The EPSS score remains high and stable, indicating that while exploitation remains feasible, the immediate threat momentum has plateaued. For defenders, this shift underscores the importance of maintaining vigilance without overestimating current exploitation intensity. The lowered CVSS score does not diminish the vulnerability’s critical nature but suggests a nuanced threat environment where active exploitation is less aggressive than initially projected. Consequently, the overall risk level remains elevated, warranting continued monitoring and response readiness, but with an adjusted perspective on adversary engagement patterns.