A critical SQL injection vulnerability in the Adivaha Travel Plugin allows unauthenticated remote attackers to extract sensitive database information or trigger denial of service conditions.

This flaw is a time-based blind SQL injection (CWE-89) triggered via the pid GET parameter within the /mobile-app/v3/ endpoint. An unauthenticated attacker can inject malicious SQL payloads to manipulate database queries.

The ability for an unauthenticated user to interact directly with the backend database poses a severe risk to data confidentiality and availability. Successful exploitation could lead to the exposure of sensitive customer information or the complete disruption of travel booking services, directly impacting revenue and organizational reputation. The CVSS score of 8.2 reflects the high severity of this remote, unauthenticated access vector.

Immediate Action: Update the Adivaha Travel Plugin to the latest available version provided by the vendor, as this version contains the necessary security hardening. If an update is not available, deactivate or remove the plugin immediately to eliminate the attack surface.

Proactive Monitoring: Monitor server access logs for unusual patterns of GET requests directed at the /mobile-app/v3/ endpoint, specifically looking for characters indicative of SQL injection such as XOR, SLEEP, or unexpected parameter length.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, particularly those targeting the pid parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Exploit-DB entry 51655.

Given the availability of a public exploit and the high severity of SQL injection vulnerabilities, this issue should be addressed with high priority. Administrators must audit their WordPress installations for the presence of the Adivaha Travel Plugin and apply updates immediately. If the plugin is no longer required for business operations, permanent removal is the safest course of action to mitigate risk.