What is the CVSS score of CVE-2024-3605?

CVE-2024-3605 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 80.4%.

Is there a public PoC exploit available for CVE-2024-3605?

Yes, a public proof-of-concept exploit is available for CVE-2024-3605. Prioritise patching immediately. EPSS: 80.4%.

Wp Hotel Booking CVE-2024-3605

CRITICAL

SQL Injection (CWE-89)

2024-06-20 security@wordfence.com

WordPress SQLi Wp Hotel Booking Wordpress Plugin Thimpress

10.0

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 10.0 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. Public proof-of-concept exploit code is available. EPSS exploitation probability: 80.45%.
Exploit ScenarioDerived	A remote attacker could execute arbitrary SQL commands against the database by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.

Emergency Immediate action required. Why: CRITICAL + EPSS > 30%, no patch available.

No patch listed yet 80.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Affected products include: Thimpress Wp Hotel Booking.

Know when Wp Hotel Booking gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Threat Intelligence Overview

Threat Score

5.9/10

Composite threat intelligence

EPSS Score

80.4%

Top 1% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS POC (1)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 80.4%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + EPSS > 30%, no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact· derived

Medium

Priority Score

150

Low Medium High Critical

KEV: 0

EPSS: +80

CVSS: +50

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

SQL Injection HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

Affected Products (CPE)CVE.org

cpe:2.3:a:thimpress:wp_hotel_booking:*:*:*:*:*:wordpress:*:*

More in Wp Hotel Booking

View all

CVE-2023-5652 CRITICAL Act Now POC

9.8 Nov 20

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not esca

CVE-2026-15153 MEDIUM This Month POC

6.8 Jul 30

SQL injection in the WP Hotel Booking WordPress plugin before 2.3.2 allows users holding plugin-specific booking-managem

CVE-2026-9822 MEDIUM This Month POC

6.5 Jun 19

Missing authorization controls in the WP Hotel Booking WordPress plugin (all versions before 2.3.1) expose sensitive hos

CVE-2026-15094 MEDIUM This Month POC

6.1 Jul 17

Reflected Cross-Site Scripting in the WP Hotel Booking WordPress plugin (ThimPress) through version 2.3.2 enables unauth

CVE-2023-5799 MEDIUM This Month POC

5.4 Nov 20

The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing

CVE-2023-5651 MEDIUM This Month POC

5.4 Nov 20

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensu

CVE-2024-7855 HIGH This Week

8.8 Oct 02

The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in

CVE-2024-51582 HIGH This Week

7.5 Nov 04

Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion

CVE-2024-30508 MEDIUM This Month

6.5 Mar 29

Missing Authorization vulnerability in ThimPress WP Hotel Booking.0.9.2. Rated medium severity (CVSS 6.5), this vulnerab

CVE-2026-15464 MEDIUM This Month

6.4 Jul 24

Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to in

CVE-2026-11392 MEDIUM This Month

6.1 Jul 10

Reflected cross-site scripting in the WP Hotel Booking WordPress plugin (all versions up to and including 2.3.1) permits

CVE-2026-11901 MEDIUM This Month

5.3 Jul 11

Payment bypass in WP Hotel Booking (WordPress plugin, all versions ≤2.3.1) allows unauthenticated attackers to mark arbi

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

9.8

CVE-2019-7481 HIGH POC

7.5

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

Same technique SQLi

View all

CVE-2013-0333 HIGH POC

7.5

References

Advisories & patches

REF https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3105864%40wp-hotel-booking&new=3105864%40wp-hotel-booking&sfp_email=&sfph_mail= REF https://wordpress.org/plugins/wp-hotel-booking/ REF https://www.wordfence.com/threat-intel/vulnerabilities/id/5931ad4e-7de3-41ac-b783-f7e58aaef569?source=cve

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back