CVE-2020-29047
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on WordPress sites using the wp-hotel-booking plugin through version 1.10.2. Attackers can exploit insecure deserialization in the plugin's session handling to achieve remote code execution. All WordPress installations with the vulnerable plugin version are affected.
💻 Affected Systems
- WordPress wp-hotel-booking plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, install backdoors, steal data, deface websites, or pivot to other systems.
Likely Case
Remote code execution leading to website defacement, data theft, or installation of malware/backdoors.
If Mitigated
Attack prevented through proper input validation and secure deserialization practices.
🎯 Exploit Status
Exploitation requires manipulating the thimpress_hotel_booking_1 cookie to trigger insecure deserialization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.3 and later
Vendor Advisory: https://wordpress.org/plugins/wp-hotel-booking/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'WP Hotel Booking' plugin
4. Click 'Update Now' if available
5. If no update available, deactivate and delete the plugin
6. Install the latest version from WordPress repository
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the wp-hotel-booking plugin until patched
wp plugin deactivate wp-hotel-booking
Web Application Firewall rule
allBlock requests containing malicious serialized data in thimpress_hotel_booking_1 cookie
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all cookie data
- Deploy web application firewall with rules to detect and block deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for wp-hotel-booking version 1.10.2 or earlierCheck Version:
wp plugin get wp-hotel-booking --field=versionVerify Fix Applied:
Verify wp-hotel-booking plugin version is 1.10.3 or later in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual PHP errors related to unserialize()
- Suspicious POST/GET requests with manipulated cookies
- Unexpected process execution from web server
Network Indicators:
- HTTP requests with thimpress_hotel_booking_1 cookie containing serialized PHP objects
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (cookie="*thimpress_hotel_booking_1*" AND (cookie="*O:*" OR cookie="*C:*" OR cookie="*a:*"))