CVE-2023-54359

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54359", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-09T20:41:39.641Z", "datePublished": "2026-04-09T20:54:49.464Z", "dateUpdated": "2026-04-14T14:49:14.120Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-09T20:55:46.494Z"}, "title": "WordPress adivaha Travel Plugin 2.3 SQL Injection via pid", "descriptions": [{"lang": "en", "value": "WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Adivaha", "product": "WordPress adivaha Travel Plugin", "versions": [{"version": "2.3", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/51655", "name": "ExploitDB-51655", "tags": ["exploit"]}, {"url": "https://www.adivaha.com/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://wordpress.org/plugins/adiaha-hotel/", "name": "Product Reference", "tags": ["product"]}, {"name": "VulnCheck Advisory: WordPress adivaha Travel Plugin 2.3 SQL Injection via pid", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wordpress-adivaha-travel-plugin-sql-injection-via-pid"}], "credits": [{"lang": "en", "value": "CraCkEr", "type": "finder"}], "x_generator": {"engine": "vulncheck"}, "datePublic": "2023-08-04T00:00:00.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T14:49:01.181781Z", "id": "CVE-2023-54359", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T14:49:14.120Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54359", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T14:49:01.181781Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T14:49:07.370Z"}}], "cna": {"title": "WordPress adivaha Travel Plugin 2.3 SQL Injection via pid", "credits": [{"lang": "en", "type": "finder", "value": "CraCkEr"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Adivaha", "product": "WordPress adivaha Travel Plugin", "versions": [{"status": "affected", "version": "2.3"}]}], "datePublic": "2023-08-04T00:00:00.000Z", "references": [{"url": "https://www.exploit-db.com/exploits/51655", "name": "ExploitDB-51655", "tags": ["exploit"]}, {"url": "https://www.adivaha.com/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://wordpress.org/plugins/adiaha-hotel/", "name": "Product Reference", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/wordpress-adivaha-travel-plugin-sql-injection-via-pid", "name": "VulnCheck Advisory: WordPress adivaha Travel Plugin 2.3 SQL Injection via pid", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-09T20:55:46.494Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54359", "state": "PUBLISHED", "dateUpdated": "2026-04-14T14:49:14.120Z", "dateReserved": "2026-04-09T20:41:39.641Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-09T20:54:49.464Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WordPress adivaha Travel Plugin", "vendor": "Adivaha", "versions": [{"status": "affected", "version": "2.3"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service."}, {"lang": "es", "value": "WordPress adivaha Travel Plugin 2.3 contiene una vulnerabilidad de inyecci\u00f3n SQL ciega basada en tiempo que permite a atacantes no autenticados manipular consultas de base de datos inyectando c\u00f3digo SQL a trav\u00e9s del par\u00e1metro GET 'pid'. Los atacantes pueden enviar solicitudes al endpoint /mobile-app/v3/ con valores 'pid' manipulados utilizando payloads basados en XOR para extraer informaci\u00f3n sensible de la base de datos o causar denegaci\u00f3n de servicio."}], "id": "CVE-2023-54359", "lastModified": "2026-09-26T23:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54359", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T14:49:01.181781Z", "version": "2.0.3"}}]}, "published": "2026-04-09T21:16:05.153", "references": [{"source": "disclosure@vulncheck.com", "url": "https://wordpress.org/plugins/adiaha-hotel/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.adivaha.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/51655"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wordpress-adivaha-travel-plugin-sql-injection-via-pid"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WordPress adivaha Travel Plugin", "source": "cna", "vendor": "Adivaha"}, "product": "wordpress_adivaha_travel_plugin", "vendor": "adivaha"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-09T22:44:53.326343+00:00", "value": {"mitigation_remediation": ["Update the WordPress adivaha Travel Plugin to the latest patched version (e.g., 2.4 or newer).", "If a patch is not immediately available, temporarily block or remove the /mobile-app/v3/ endpoint or the 'pid' parameter to prevent exploitation.", "Replace the adivaha Travel Plugin with a secure alternative until the patch is released.", "Verify that the 'pid' GET parameter is validated to accept only numeric values and that all SQL queries use parameterized statements.", "Enable logging and monitor the /mobile-app/v3/ endpoint for unusual activity to detect potential exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Data Exfiltration"}, "threat_synthesis": {"affected_systems": "Adivaha's WordPress adivaha Travel Plugin, specifically version 2.3, is affected by this flaw. Administrators using this plugin on any WordPress site should verify their installed version. No additional vendor product versions are listed in the advisory; therefore, only the stated version should be considered vulnerable.", "description_and_impact": "WordPress adivaha Travel Plugin version 2.3 contains a time\u2011based blind SQL injection that can be triggered by an unauthenticated attacker using the 'pid' GET parameter on the /mobile-app/v3/ endpoint. The vulnerability allows the attacker to inject XOR\u2011based SQL payloads that cause the database to pause, revealing data character by character or exhausting resources, resulting in data exposure or denial of service.", "risk_and_exploitability": "The CVSS score of 8.8 signals a high severity, with attackers able to exploit the flaw remotely without authentication. The EPSS score is unavailable, so the current exploit probability is undetermined, but the known existence of an exploitation script on ExploitDB indicates that the vulnerability is actively tracked. Because the endpoint is publicly reachable, the attack vector is purely over HTTP, and an attacker simply needs to craft a URL containing the malicious 'pid' value to trigger the injection. The vulnerability is not listed in the CISA KEV catalog."}}}}, "created": "2026-04-10T08:38:30.926814+00:00", "updated": "2026-04-10T09:29:15.186829+00:00", "vendors": ["adivaha", "adivaha$PRODUCT$wordpress_adivaha_travel_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}