{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54359", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-09T20:41:39.641Z", "datePublished": "2026-04-09T20:54:49.464Z", "dateUpdated": "2026-04-09T20:55:46.494Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-09T20:55:46.494Z"}, "title": "WordPress adivaha Travel Plugin 2.3 SQL Injection via pid", "descriptions": [{"lang": "en", "value": "WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Adivaha", "product": "WordPress adivaha Travel Plugin", "versions": [{"version": "2.3", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/51655", "name": "ExploitDB-51655", "tags": ["exploit"]}, {"url": "https://www.adivaha.com/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://wordpress.org/plugins/adiaha-hotel/", "name": "Product Reference", "tags": ["product"]}, {"name": "VulnCheck Advisory: WordPress adivaha Travel Plugin 2.3 SQL Injection via pid", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wordpress-adivaha-travel-plugin-sql-injection-via-pid"}], "credits": [{"lang": "en", "value": "CraCkEr", "type": "finder"}], "x_generator": {"engine": "vulncheck"}, "datePublic": "2023-08-04T00:00:00.000Z"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service."}], "id": "CVE-2023-54359", "lastModified": "2026-04-09T21:16:05.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-04-09T21:16:05.153", "references": [{"source": "disclosure@vulncheck.com", "url": "https://wordpress.org/plugins/adiaha-hotel/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.adivaha.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/51655"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wordpress-adivaha-travel-plugin-sql-injection-via-pid"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WordPress adivaha Travel Plugin", "source": "cna", "vendor": "Adivaha"}, "product": "wordpress_adivaha_travel_plugin", "vendor": "adivaha"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-09T22:44:53.326343+00:00", "value": {"mitigation_remediation": ["Update the WordPress adivaha Travel Plugin to the latest patched version (e.g., 2.4 or newer).", "If a patch is not immediately available, temporarily block or remove the /mobile-app/v3/ endpoint or the 'pid' parameter to prevent exploitation.", "Replace the adivaha Travel Plugin with a secure alternative until the patch is released.", "Verify that the 'pid' GET parameter is validated to accept only numeric values and that all SQL queries use parameterized statements.", "Enable logging and monitor the /mobile-app/v3/ endpoint for unusual activity to detect potential exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Data Exfiltration"}, "threat_synthesis": {"affected_systems": "Adivaha's WordPress adivaha Travel Plugin, specifically version 2.3, is affected by this flaw. Administrators using this plugin on any WordPress site should verify their installed version. No additional vendor product versions are listed in the advisory; therefore, only the stated version should be considered vulnerable.", "description_and_impact": "WordPress adivaha Travel Plugin version 2.3 contains a time\u2011based blind SQL injection that can be triggered by an unauthenticated attacker using the 'pid' GET parameter on the /mobile-app/v3/ endpoint. The vulnerability allows the attacker to inject XOR\u2011based SQL payloads that cause the database to pause, revealing data character by character or exhausting resources, resulting in data exposure or denial of service.", "risk_and_exploitability": "The CVSS score of 8.8 signals a high severity, with attackers able to exploit the flaw remotely without authentication. The EPSS score is unavailable, so the current exploit probability is undetermined, but the known existence of an exploitation script on ExploitDB indicates that the vulnerability is actively tracked. Because the endpoint is publicly reachable, the attack vector is purely over HTTP, and an attacker simply needs to craft a URL containing the malicious 'pid' value to trigger the injection. The vulnerability is not listed in the CISA KEV catalog."}}}}, "created": "2026-04-10T08:38:30.926814+00:00", "updated": "2026-04-10T09:29:15.186829+00:00", "vendors": ["adivaha", "adivaha$PRODUCT$wordpress_adivaha_travel_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}