WP Booking System CVE-2026-107712

Exploitation requires an authenticated WordPress account with subscriber-level capabilities or higher (PR:L); on sites that permit open user registration this bar is low, but on sites with registration disabled it meaningfully limits attackers. The specific trigger is supplying a crafted 'current_month' parameter to the plugin's calendar AJAX handler (functions-actions-ajax-calendar.php), which reaches the vulnerable unprepared query in the booking object-DB layer. A key enabling factor is the regression in version 2.1: the capability check added in 2.0.19.11-2.0.19.14 to fix CVE-2024-50425 was removed, and no nonce validation is performed, so any logged-in subscriber can reach the handler. The product must be WP Booking System - Booking Calendar at version 2.1.0.1 or earlier; no user interaction or non-default configuration beyond having an account is needed.

This is a moderate-priority vulnerability that is real but not an emergency. The CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity SQL injection whose impact is bounded to confidentiality (C:H, I:N, A:N) and which requires authentication (PR:L). The most important mitigating signal is the privilege requirement: the attacker needs a valid subscriber-level account, so this is not an unauthenticated internet-facing bug - but subscriber accounts are often self-registerable on WordPress sites, which materially lowers the real barrier. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence, so this is best characterized as no public exploit identified at time of analysis rather than an actively exploited threat. The signals are internally consistent (no CVSS-vs-description conflict), but note the regression context raises concern: a prior capability check added to fix CVE-2024-50425 was reintroduced as a gap in version 2.1, and there is no nonce validation, meaning the vulnerable AJAX handler is trivially reachable once authenticated. Net assessment: a genuine data-disclosure risk that should be patched promptly on sites allowing open registration, but it lacks the exploitation evidence (KEV/EPSS/POC) that would make it a drop-everything priority.

An attacker registers or obtains a subscriber-level account on a WordPress site running WP Booking System ≤ 2.1.0.1, then sends an authenticated AJAX request to the calendar handler with a malicious 'current_month' parameter. Because the parameter is insufficiently escaped and the SQL query is not properly prepared, the attacker injects a time-based blind SQL payload that lets them infer and extract sensitive database contents (e.g., user data, password hashes) one conditional response-delay at a time. No public exploit code was identified, but the low attack complexity and absence of nonce validation make the vulnerable handler straightforward to reach.