WP Booking System CVE-2026-111178

Requires an authenticated WordPress account with Administrator-level privileges or above (per PR:H), which is the primary limiting factor. Additionally, the targeted booking calendar must contain more than 200 bookings, because the 'data[orderby]' value is only forwarded to the database layer when the AJAX booking handler enters the use_ajax branch; below that threshold the sink is not reached. This is a non-default state, though an Administrator can deliberately satisfy it by creating bookings directly. There is no unauthenticated or low-privilege path and no user interaction is required once admin access is held; impact is limited to confidentiality (database read/extraction) with no integrity or availability effect.

This is a genuinely low-to-moderate priority issue despite the CWE-89 SQL injection classification, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9 Medium) is the dominant signal: the PR:H requirement means exploitation demands WordPress administrator-level access, which is the single most important mitigating factor. An attacker who already holds Administrator rights can typically read the database through many legitimate channels, so the marginal risk added by this specific SQLi is limited - it mainly matters in multi-tenant or least-privilege scenarios where an admin is not expected to have raw SQL capability. No EPSS score was provided, no CISA KEV listing is present, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The confidentiality-only impact (C:H, I:N, A:N) correctly reflects that this is a data-extraction flaw, not a code-execution or destructive one. There are no conflicting signals here: network attack vector plus high privileges plus a non-default precondition (>200 bookings) all point to a flaw that is real but low-urgency, best handled through routine patching rather than emergency response.

An authenticated WordPress Administrator (or a compromised/rogue admin account) on a site running WP Booking System ≤2.1.0.1 targets a booking calendar containing more than 200 bookings, then submits a crafted 'data[orderby]' value through the AJAX booking handler. Because the parameter is insufficiently escaped and the query is not properly prepared, the attacker appends additional SQL and extracts sensitive data such as user records or secrets from the WordPress database. No public exploit code is identified at time of analysis, and the attacker can create the required bookings directly to meet the 200-booking precondition.