The Solidres – Hotel booking plugin version 0.9.4 and earlier contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw can be exploited remotely over the network by an attacker with low privileges and no user interaction required, potentially leading to unauthorized disclosure of sensitive data and limited denial of service. The vulnerability is tracked as CVE-2025-23911 with a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). No patch or official fix has been documented in the provided data.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL queries, leading to high confidentiality impact by exposing sensitive data and a low impact on availability. Integrity impact is not indicated. The vulnerability affects the confidentiality of the system's data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin and monitoring for unusual database activity. Avoid exposing the affected plugin to untrusted users. No official patch or workaround information is provided in the current data.