Read the docs
TI-2026-70283 Aliases CVE-2026-107712GHSA-2mjp-56p5-fv52

SQL injection in WP Booking System WordPress plugin

Priority LOW 28CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The WP Booking System (Booking Calendar) plugin for WordPress is affected in all versions through 2.1.0.1. Insufficient escaping and an unprepared SQL query in the current_month parameter let attackers append SQL queries to existing ones (CWE-89). An authenticated attacker with subscriber-level access or higher can extract sensitive data from the database using time-based injection. This is a regression, because a capability check added for CVE-2024-50425 was removed in version 2.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
murgrolandWP Booking System – Booking Calendarup to 2.1.0.1—No fix listedCNA
  • WP Booking System – Booking Calendar Vendormurgroland Affected up to 2.1.0.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for WP Booking System (Booking Calendar).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107712
  2. 2026-10-10 Alias added: GHSA-2mjp-56p5-fv52
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-11 CISA SSVC decision points changed

References

Other 7

  • TI-2026-83495 Missing authorization in WP Booking System allows note deletion CVSS 3.1CRITICAL 9.1
  • TI-2026-76013 Missing authorization in WP Booking System exposes booking emails CVSS 3.1HIGH 7.5
  • TI-2026-76022 Missing authorization in WP Booking System allows access escalation CVSS 3.1MEDIUM 6.8
  • TI-2026-76021 Missing authorization in WP Booking System exposes booking data CVSS 3.1MEDIUM 6.5
  • TI-2026-75287 SQL injection in WP Booking System plugin via orderby parameter CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences