EUVD-2026-43143
GHSA-3h3p-33f5-225r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend POST to /wp-json/booking-package/v1/request
-
DeliveryCraft is_email-passing 'email' payload
-
ExploitAppend SQL past unprepared query
-
ExecutionBypass unauthenticated permission_callback
-
ImpactExtract limited database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Reachable against default installations because the /wp-json/booking-package/v1/request REST endpoint is registered with permission_callback: __return_true (no authentication, nonce, or capability check) and REST $_POST values skip wp_magic_quotes escaping, so a single quote in the 'email' field reaches the SQL query. The exploit requires the plugin to be installed and active and a form (form<N>) to be present. The decisive limiting factor is that the injected value must first satisfy WordPress's is_email() validation, which rejects most SQL syntax and metacharacters - this is why the vendor describes impact as severely limited, and it is the primary control constraining real-world data extraction. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) rates this High on the basis of unauthenticated network reachability and high confidentiality impact, and the unauthenticated REST endpoint is confirmed. However, this raw score materially overstates practical risk: the CVE description itself states impact is 'severely limited' because the injectable parameter must pass is_email(), which forbids most characters and syntax needed for effective UNION-based or boolean/time-based extraction, dramatically raising real attack complexity. No EPSS score was supplied, the CVE is not in CISA KEV, and no proof-of-concept is referenced (no public exploit identified at time of analysis). There is no SSVC decision data provided. Net assessment: reachability is real and unauthenticated, but the is_email() constraint means this is closer to a constrained/low-yield injection than a turnkey database dump - I independently down-rate confidentiality to Low and complexity to High. Note the tension explicitly: CVSS marks C:H while the vendor description calls impact severely limited - treat the 7.5 as an upper bound, not the expected real-world outcome. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted POST request to /wp-json/booking-package/v1/request with a malicious 'email' form parameter that passes is_email() format checks yet embeds appended SQL, aiming to read data such as user records or credentials from the WordPress database. Given AV:N/AC:L reachability the request needs no authentication or user interaction, but the is_email() filter forces the attacker into a heavily constrained payload, limiting what can realistically be exfiltrated; no public proof-of-concept is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer masaakitanaka) lets remote attackers append SQL to an existing query via the 'email' form parameter on the /wp-json/booking-package/v1/request REST endpoint, enabling extraction of sensitive database contents. The endpoint is registered with permission_callback __return_true and REST-sourced $_POST values bypass wp_magic_quotes, so single quotes reach the SQL sink without authentication. Exploitability is severely constrained because the parameter is filtered through WordPress's is_email() before use, and there is no public exploit identified at time of analysis.
RemediationAI
Upgrade to the first Booking Package release published after 1.7.20 that incorporates the referenced trac changeset (3602166); an upstream fix is available per the WordPress.org changeset but a specific tagged patched version is not independently confirmed from the provided data, so verify the fixed version on the plugin's WordPress.org page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc86a29-cb1f-4711-925c-51dbbf682477?source=cve) before relying on it. Until patched, restrict or block POST access to the /wp-json/booking-package/v1/request REST route at the WAF or web-server layer (Wordfence/ModSecurity rules or a location block), accepting that this may break legitimate booking-request submissions; alternatively disable the plugin if booking functionality is non-essential. Because the endpoint is unauthenticated by design, IP allow-listing is impractical for a public booking form, so a WAF rule inspecting the 'email' parameter for SQL metacharacters is the most targeted stopgap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL Injection in a PHP/WordPress plugin. The root cause is that the 'email' value from a numbered form field (form<N>) is concatenated into a SQL statement in lib/Schedule.php (around lines 9365 and 12793) without wpdb->prepare() and without adequate escaping. Two WordPress-specific mechanics amplify reachability: the plugin registers its REST route with permission_callback: __return_true (no capability or nonce check), and WordPress's wp_magic_quotes()/magic-quotes escaping is not applied to $_POST data sourced through the REST API, so single quotes in the payload survive intact to the query sink. The only inbuilt sanitizer in the path is is_email(), a format validator (not a security control), which restricts the character set an attacker can inject. Affected package per CPE is cpe:2.3:a:masaakitanaka:booking_package.
Know when Booking Package gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint (PR:N/AV:N), but the is_email() filter forces constrained payloads (AC:H) and severely limits data extraction (C:L); no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint /wp-json/booking-package/v1/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.
Articles & Coverage 1
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Booking Package
View allThe Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's bookin
Payment amount manipulation in the Booking Package WordPress plugin (versions before 1.7.25) allows unauthenticated remo
Unauthenticated information disclosure in the WordPress Booking Package plugin before 1.7.31 exposes calendar-account co
Booking Package WordPress plugin before 1.7.31 allows unauthenticated remote attackers to reset its premium subscription
Insecure cancellation-token generation in the Booking Package WordPress plugin before 1.7.31 allows unauthenticated atta
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retr
Unauthenticated broken access control in the SaaSProject Booking Package WordPress plugin versions 1.7.06 and earlier al
Privilege escalation in the Booking Package plugin for WordPress (versions up to and including 1.7.16) allows authentica
Stored cross-site scripting in the Booking Package WordPress plugin (versions up to and including 1.7.29) allows authent
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 all
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices
Exploit-DB