WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerability

The SQL Injection vulnerability in GoodLayers Hotel poses a significant risk to WordPress websites using the plugin. An attacker could exploit this flaw to bypass authentication and gain unauthorized access to the database. This could lead to the exfiltration of sensitive user data, including usernames, passwords, email addresses, and potentially financial information if the plugin interacts with e-commerce functionality. The blind nature of the injection means the attacker doesn't receive direct feedback from the database, requiring more sophisticated techniques to extract data, but the potential impact remains severe. Successful exploitation could also allow for modification or deletion of data, leading to website defacement or complete data loss.

Websites using GoodLayers Hotel plugin, particularly those with sensitive user data or e-commerce functionality, are at risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose data from others.

• wordpress / composer / npm:

grep -r "gdlr-hotel" /var/www/html/wp-content/plugins/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/gdlr-hotel/ | grep SQL

• wordpress / composer / npm:

wp plugin list | grep gdlr-hotel

1. 2025-05-23Disclosure

   disclosure

1. Gereserveerd2025-04-16
2. Gepubliceerd2025-05-23
3. Gewijzigd2026-04-28
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-39504 is to immediately upgrade GoodLayers Hotel to version 3.1.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. As a short-term workaround, implement a Web Application Firewall (WAF) with rules to filter potentially malicious SQL injection attempts targeting the vulnerable endpoints. Monitor WordPress access logs for suspicious SQL queries, particularly those involving special characters or unusual patterns. While a direct detection signature is difficult to create for blind SQL injection, monitoring for unusual database activity can provide early warning signs.