CVE-2024-13235 is an SQL Injection vulnerability identified in the Pinpoint Booking System, a widely used WordPress booking plugin developed by dotonpaper. The vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89) specifically via the 'language' parameter. This parameter is used in SQL queries without sufficient escaping or prepared statements, allowing attackers with authenticated access at the Subscriber level or higher to append malicious SQL code. This can lead to unauthorized extraction of sensitive information from the backend database. The vulnerability affects all plugin versions up to and including 2.9.9.5.2. The CVSS v3.1 score is 6.5 (medium severity), reflecting that the attack vector is network-based, requires low privileges, no user interaction, and impacts confidentiality but not integrity or availability. Although no public exploits are known, the ease of exploitation by authenticated users makes this a significant risk. The vulnerability highlights the importance of proper input validation and use of parameterized queries in WordPress plugins to prevent injection attacks.

The primary impact of this vulnerability is unauthorized disclosure of sensitive data stored in the WordPress site's database, which may include user information, booking details, and potentially other confidential data. Since the attacker needs only Subscriber-level access, which is commonly granted to registered users, the attack surface is broad. This can lead to privacy violations, compliance issues, and reputational damage for organizations using the affected plugin. While the vulnerability does not allow modification or deletion of data (integrity) or cause denial of service (availability), the confidentiality breach alone can have serious consequences, especially for businesses handling personal or payment information. The risk is amplified for organizations relying heavily on this plugin for booking and customer management, including e-commerce, hospitality, and service industries worldwide.

Organizations should immediately update the Pinpoint Booking System plugin to a patched version once available. In the absence of an official patch, administrators should restrict Subscriber-level user capabilities to minimize risk, such as disabling the ability to modify the 'language' parameter or limiting access to the booking system backend. Employing Web Application Firewalls (WAFs) with SQL Injection detection rules can help block malicious payloads targeting this parameter. Additionally, site owners should audit user roles and permissions to ensure minimal privileges are assigned. Regular database backups and monitoring for unusual query patterns can aid in early detection of exploitation attempts. Developers maintaining the plugin should implement parameterized queries and proper input sanitization to prevent similar vulnerabilities in the future.