CVE-2024-3605: 
WordPress vulnerability analysis and mitigation

The WP Hotel Booking plugin for WordPress contains a SQL Injection vulnerability (CVE-2024-3605) in all versions up to and including 2.1.0. The vulnerability exists in the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint due to insufficient escaping of user-supplied parameters and inadequate SQL query preparation (NVD).

The vulnerability is classified as Critical with a CVSS v3.1 Base Score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) according to NVD, while Wordfence assessed it with a CVSS score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The vulnerability is categorized as CWE-89 (SQL Injection) and affects the plugin's search functionality through improper neutralization of special elements in SQL commands (NVD).

The vulnerability allows unauthenticated attackers to append additional SQL queries to existing queries, potentially leading to the extraction of sensitive information from the database. This could result in unauthorized access to data and potential compromise of the WordPress installation (NVD).

The vulnerability can be exploited by unauthenticated attackers remotely through the REST API endpoint, requiring no special privileges or user interaction. The attack vector is considered low complexity, making it relatively straightforward to exploit (NVD).

Users should immediately update to a version newer than 2.1.0 of the WP Hotel Booking plugin. The vulnerability has been addressed in subsequent releases, with version 2.1.1 specifically fixing security issues (WordPress Plugin).