EUVD-2026-43143
GHSA-3h3p-33f5-225r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint (PR:N/AV:N), but the is_email() filter forces constrained payloads (AC:H) and severely limits data extraction (C:L); no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint /wp-json/booking-package/v1/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer masaakitanaka) lets remote attackers append SQL to an existing query via the 'email' form parameter on the /wp-json/booking-package/v1/request REST endpoint, enabling extraction of sensitive database contents. The endpoint is registered with permission_callback __return_true and REST-sourced $_POST values bypass wp_magic_quotes, so single quotes reach the SQL sink without authentication. Exploitability is severely constrained because the parameter is filtered through WordPress's is_email() before use, and there is no public exploit identified at time of analysis.
Technical ContextAI
The flaw is a classic CWE-89 SQL Injection in a PHP/WordPress plugin. The root cause is that the 'email' value from a numbered form field (form<N>) is concatenated into a SQL statement in lib/Schedule.php (around lines 9365 and 12793) without wpdb->prepare() and without adequate escaping. Two WordPress-specific mechanics amplify reachability: the plugin registers its REST route with permission_callback: __return_true (no capability or nonce check), and WordPress's wp_magic_quotes()/magic-quotes escaping is not applied to $_POST data sourced through the REST API, so single quotes in the payload survive intact to the query sink. The only inbuilt sanitizer in the path is is_email(), a format validator (not a security control), which restricts the character set an attacker can inject. Affected package per CPE is cpe:2.3:a:masaakitanaka:booking_package.
RemediationAI
Upgrade to the first Booking Package release published after 1.7.20 that incorporates the referenced trac changeset (3602166); an upstream fix is available per the WordPress.org changeset but a specific tagged patched version is not independently confirmed from the provided data, so verify the fixed version on the plugin's WordPress.org page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc86a29-cb1f-4711-925c-51dbbf682477?source=cve) before relying on it. Until patched, restrict or block POST access to the /wp-json/booking-package/v1/request REST route at the WAF or web-server layer (Wordfence/ModSecurity rules or a location block), accepting that this may break legitimate booking-request submissions; alternatively disable the plugin if booking functionality is non-essential. Because the endpoint is unauthenticated by design, IP allow-listing is impractical for a public booking form, so a WAF rule inspecting the 'email' parameter for SQL metacharacters is the most targeted stopgap.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today