Directorist Booking CVE-2026-22336

No special conditions - remote unauthenticated exploitation against default configurations of Directorist Booking plugin versions prior to 3.0.2. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerability is exploitable over the network with low attack complexity, requiring no authentication and no user interaction. Attackers need only identify WordPress sites running the vulnerable plugin version, which can be accomplished through automated scanning for plugin-specific file paths or HTTP headers. However, exploitation is limited to sites that have the Directorist Booking plugin actively installed and enabled, which narrows the attack surface compared to WordPress core vulnerabilities.

This vulnerability presents significant real-world risk despite no confirmed active exploitation. The CVSS base score of 9.3 (Critical) accurately reflects the attack surface: network-accessible, low complexity, no authentication or user interaction required. The Changed scope indicates database compromise could expose data from other WordPress plugins and core tables beyond Directorist Booking itself. However, several factors moderate immediate urgency: no CISA KEV listing indicates no widespread exploitation campaigns detected; EPSS data not available but unauthenticated SQLi vulnerabilities in WordPress plugins typically attract automated scanning within weeks of public disclosure; the Integrity impact is None (I:N), meaning attackers cannot modify database contents through this specific vector, limiting it to read-only data exfiltration and availability attacks. The Patchstack advisory publication creates a time-sensitive window where attackers may reverse-engineer the vulnerability from the advisory details even without a working proof-of-concept. Organizations running Directorist Booking must prioritize patching, as unauthenticated SQLi in web-facing applications represents one of the highest-priority vulnerability classes per SSVC framework: exploitable remotely, likely automatable for scanning, high technical impact to confidentiality.

An unauthenticated remote attacker crafts a malicious HTTP request to a Directorist Booking endpoint, injecting SQL commands into a vulnerable parameter that lacks proper input sanitization. The injected SQL executes with the privileges of the WordPress database user, allowing the attacker to extract sensitive information such as user credentials, email addresses, booking records, and WordPress configuration secrets from the database. The attacker could also execute UNION-based or time-based blind SQL injection to enumerate database structure and exfiltrate data systematically, or craft resource-intensive queries to degrade site performance.