Improper control of code generation, identified as code injection, allows an attacker to run arbitrary code through Jetmonsters Hotel Booking Lite. The vulnerability, classified as CWE‑94, permits Remote Code Inclusion via crafted input to the plugin. An attacker who can influence the plugin’s input fields could deploy malicious scripts or backdoors on the affected WordPress site, compromising the confidentiality, integrity, and availability of the web application.

This issue affects Jetmonsters Hotel Booking Lite, known as the Motopress Hotel Booking Lite plugin, across all installed versions up to and including 5.2.3. Users running any version dated from the original release (n/a) through 5.2.3 are vulnerable. No information about earlier or later versions is provided.

With a CVSS score of 9.1, the vulnerability is regarded as critical. The EPSS score of less than 1% indicates a low current probability of exploitation, and the asset has not yet been listed in CISA’s KEV catalog. The likely attack vector, inferred from the description, is remote exploitation through legitimate plugin usage. An attacker could exploit the plugin when it processes data from unauthenticated or authenticated users, leading to complete loss of control over the affected WordPress installation.