CVE-2024-13235

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Feb 21, 2025
Updated: Feb 25, 2025
CWE ID 89

Summary

CVE-2024-13235 is a vulnerability affecting the Pinpoint Booking System plugin for WordPress, which is the #1 WordPress booking plugin. This issue exposes SQL Injection vulnerabilities in all versions up to and including 2.9.9.5.2. The root cause is insufficient escaping of the 'language' parameter, which allows authenticated attackers with Subscriber-level access and above to append malicious SQL queries to existing ones. These queries can then be used to extract sensitive information from the database.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Pinpoint Booking System

Affected Vendors

  • Pinpoint

Advisories, Assessments, and Mitigations