CVE-2024-3605 is a critical SQL injection (CVSS 10.0) in the WP Hotel Booking plugin for WordPress, in all versions up to and including 2.1.0. The room_type parameter of the search-rooms REST endpoint is not escaped. Unauthenticated attackers can append queries. The plugin changelog lists a security fix in 2.1.1, so update to that or later.
Weakness class: CWE-89.
What's affected
- Product: WP Hotel Booking, a WordPress plugin by ThimPress.
- Affected: all versions up to and including 2.1.0.
- Fixed: the WordPress.org changelog lists 2.1.1 (21 June 2024) as "Fixed: security" without detail. The 2.1.0 entry lists no security fix. This is a changelog inference, so check the vendor advisory too.
- Endpoint: the /wphb/v1/rooms/search-rooms REST route.
- Access needed: none.
- Severity: Critical, CVSS 10.0, per the record. The KEV flag is false.
How to check if you're exposed
- In the WordPress admin, open Plugins and read the version of WP Hotel Booking.
- With WP-CLI, list the plugin version.
wp plugin list | grep wp-hotel-booking
- Search web server logs for requests to the search-rooms endpoint with unusually long or encoded parameters.
- Compare the user table and options against a recent backup to spot unexpected changes.
What to do now
- Update WP Hotel Booking to 2.1.1 or later, and preferably to the current release, since the changelog shows later security fixes.
- If you cannot update, deactivate the plugin until you can.
- Add a firewall rule on the REST route as a temporary measure only.
- Reduce the database account to the rights WordPress needs.
- After patching, review administrator accounts, options and booking data for tampering.
Why it matters
The class is CWE-89. A REST parameter goes into a SQL statement without preparation, and the endpoint is public because visitors need to search rooms. That combination, no login and direct database reach, is why the score is the maximum.
A booking site stores guest names, contact details and sometimes partial payment data. A read primitive is a data breach, and a write primitive can create admin users. The remedy is the same as always: prepared statements with bound parameters.
The plugin changelog shows security fixes in many later releases. That is a good reason to stay on the latest version rather than the minimum fixed one.
If the site took bookings while it ran an affected version, treat guest data as potentially read. Check your obligations for notifying guests, and keep web server logs from that period, since they are the best evidence of what was requested.
Quick check
Is login required to exploit CVE-2024-3605?
No. The record says unauthenticated attackers can exploit it.
Which release fixes it?
The WordPress.org changelog lists a security fix in 2.1.1. Confirm with the vendor.
Sources
Last reviewed: 19 October 2026.
