EUVD-2026-39167
GHSA-x3xm-75xg-4hgf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible endpoint requires only subscriber auth (PR:L); time-based SQLi yields database read access (C:H) with no write or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Time-based blind SQL injection in the Gravity Forms Booking plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to exfiltrate sensitive data from the underlying WordPress database via the 'staff_id' parameter. All plugin versions through 2.7.1 are affected due to insufficient input escaping and inadequate SQL query preparation on a user-controlled parameter. No public exploit code or active exploitation has been identified at time of analysis, though the low authentication barrier (subscriber-level) meaningfully broadens attacker opportunity on sites with open registration.
Technical ContextAI
The vulnerability resides in the Gravity Forms Booking plugin (CPE: cpe:2.3:a:gravitymore:gravity_bookings:*:*:*:*:*:*:*:*), a WordPress add-on that integrates appointment and staff-scheduling functionality with the Gravity Forms form builder. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in how the 'staff_id' parameter is passed into an existing SQL query without proper parameterized query preparation or sufficient character escaping. The time-based exploitation technique means the attacker infers database content indirectly by measuring server response delays caused by injected conditional SQL statements (e.g., SLEEP() or BENCHMARK()), rather than receiving data directly in the HTTP response. This class of injection is noisier and slower than error-based or union-based SQLi but does not require error output to be visible, making it viable across a wide range of server configurations.
RemediationAI
Site administrators should update the Gravity Forms Booking plugin beyond version 2.7.1 immediately; the vendor changelog at https://gravitybooking.com/docs/gravity-forms-booking/changelog/ should be consulted to identify the specific patched release version, as no exact fix version is confirmed from the available data. As a compensating control where immediate patching is not possible, disable WordPress open user registration to prevent unauthenticated individuals from obtaining subscriber-level accounts and thereby eliminate the primary attacker opportunity - note that this may impact legitimate user self-signup flows. Additionally, deploying a WordPress-aware web application firewall (WAF) rule targeting time-based SQL injection patterns in the 'staff_id' parameter can provide detection and blocking coverage, though WAF bypass is always possible and does not substitute for patching. If the booking plugin is not actively in use, deactivating it entirely removes the attack surface.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today