The WP Hotel Booking WordPress plugin prior to version 2.3.2 contains a SQL injection vulnerability (CWE-89) due to improper sanitization and escaping of a search parameter in an administrative listing. Users with booking-management roles can exploit this to inject malicious SQL queries, potentially compromising the database integrity or confidentiality. No CVSS score or detailed vendor advisory is currently available, and no patch information has been provided.

Users with booking-management roles can exploit this vulnerability to perform SQL injection attacks, which may lead to unauthorized data access, data modification, or other database-related impacts depending on the attacker's capabilities and database configuration. The exact impact depends on the privileges of the affected database user and the nature of the injected queries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict booking-management role permissions and avoid exposing the vulnerable administrative search functionality to untrusted users.