CVE-2024-11912 is a blind time-based SQL Injection vulnerability in the ShineTheme Travel Booking WordPress Theme affecting all versions up to 3.1.6. The issue stems from improper neutralization of special elements in the 'order_id' parameter, enabling unauthenticated attackers to append malicious SQL queries. This vulnerability allows attackers to extract sensitive information from the backend database by exploiting the insufficient escaping and lack of prepared statements in the SQL query construction.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not directly impact data integrity or availability but compromises confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable parameter if possible and monitor for updates from ShineTheme. Avoid exposing the affected parameter to untrusted users.