CVE-2020-29047: 
WordPress vulnerability analysis and mitigation

The wp-hotel-booking plugin through version 1.10.2 for WordPress contains an unauthenticated remote code execution vulnerability (CVE-2020-29047). The vulnerability stems from an unsafe unserialize operation on the thimpress_hotel_booking_1 cookie in the load function within includes/class-wphb-sessions.php. This critical vulnerability was discovered on November 17, 2020, by Nick Blundell of AppCheck Ltd and was fixed in version 1.10.4 released on March 19, 2021 (AppCheck Advisory).

The vulnerability is classified as CWE-502: Deserialization of Untrusted Data with a CVSS v3.1 base score of 9.8 (CRITICAL). The issue occurs in the load function where the plugin unsafely deserializes the value of the thimpress_hotel_booking_1 cookie without proper sanitization. While version 1.10.3 attempted to fix the issue by implementing sanitize_text_field() on the cookie value, this solution was insufficient against PHP Object Injection attacks. The vulnerability was fully patched in version 1.10.4 by switching from PHP serialization to JSON (WPScan).

The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the affected WordPress installation. If the WordPress version is below 5.5.2, attackers can achieve Remote Code Execution (RCE) through available gadget chains. Even on newer WordPress versions, attackers might still achieve RCE by leveraging gadget chains from other installed plugins (WPScan).

Website administrators should immediately update the WP Hotel Booking plugin to version 1.10.4 or later to address this vulnerability. The fix implemented in this version properly addresses the PHP Object Injection vulnerability by replacing the serialization method with JSON (WPScan).