WP Hotel Booking - SQLi (CVE-2024-3605)
Description
The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
psychologyCrowdSec Analysis
CVE-2024-3605 is a critical SQL injection vulnerability in the WP Hotel Booking plugin for WordPress, affecting all versions up to and including 2.1.0. This flaw allows unauthenticated attackers to exploit the 'room_type' parameter in the /wphb/v1/rooms/search-rooms REST API endpoint, enabling them to execute arbitrary SQL queries. Successful exploitation could lead to the extraction of sensitive database information, compromise of user data, or even full site takeover. This vulnerability poses a severe risk to websites using the affected plugin.
CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-3605 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /wp-json/wphb/v1/rooms/search-rooms REST API endpoint by injecting malicious SQL code into the room_type parameter, enabling unauthorized access to sensitive database information.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-06-20 |
| Rule Released | 2026-03-30 |
| CrowdSec First Seen | 2026-04-07 |