CVE-2023-54359: SQL Injection in WordPress adivaha Travel Plugin

Successful exploitation of CVE-2023-54359 allows an attacker to extract sensitive data stored within the WordPress database. This could include user credentials, customer information, and potentially other confidential data depending on the plugin’s configuration and data storage practices. The time-based nature of the injection means data extraction is a slower process, but it doesn't prevent an attacker from systematically querying the database. Beyond data exfiltration, the attacker could also potentially cause a denial of service by injecting SQL code that disrupts database operations or corrupts data. The lack of authentication required significantly broadens the attack surface, making the vulnerability particularly concerning.

1. Reserved2026-04-09
2. Published2026-04-09
3. Modified2026-04-15
4. EPSS updated2026-04-17

The primary mitigation for CVE-2023-54359 is to immediately upgrade the adivaha Travel Plugin to version 2.4 or later, which contains the necessary fix. If upgrading is not immediately feasible, implement a Web Application Firewall (WAF) rule to filter requests to the /mobile-app/v3/ endpoint that contain suspicious characters or patterns in the 'pid' parameter. Specifically, look for XOR-based payloads or other SQL injection attempts. Consider using a WordPress security plugin with SQL injection protection capabilities. After upgrading, confirm the vulnerability is resolved by attempting a controlled injection test on the /mobile-app/v3/ endpoint with a benign SQL query.

Last updated

7.0recently