Input validation vulnerability in Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking 2.15.3

The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress has a security issue where unauthorized users can access sensitive information through the ‘enquiry_id’ parameter in the ‘tf_enquiry_reply_email_callback’ function. This vulnerability affects all versions up to 2.15.3 and is caused by inadequate protection of the user-supplied parameter and lack of proper preparation for SQL queries. This means that attackers with Subscriber-level access or higher can add their own SQL queries to existing ones and potentially access sensitive data from the database.