What is the CVSS score of CVE-2026-32358?

CVE-2026-32358 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Booking Calendar are affected by CVE-2026-32358?

A SQL injection vulnerability in the Booking Calendar plugin (versions ≤10.14.15) allows attackers to extract sensitive data from WordPress databases without authentication.

How to fix or mitigate CVE-2026-32358?

Within 24 hours: Disable the Booking Calendar plugin and assess if customer data has been accessed; notify your hosting provider and security team. Within 7 days: Inventory all instances of Booking Calendar across your WordPress installations; implement database access logging and review recent logs for suspicious queries. Within 30 days: Evaluate alternative booking plugins with active security support; plan migration strategy and conduct database integrity audit once patch becomes available.

Booking Calendar CVE-2026-32358

EUVD-2026-11848 HIGH

SQL Injection (CWE-89)

2026-03-13 Patchstack

SQLi Booking Calendar

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11848

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.

AnalysisAI

Booking Calendar versions 10.14.15 and earlier contain a blind SQL injection vulnerability in database query handling that allows high-privileged authenticated users to execute arbitrary SQL commands. An attacker with administrative credentials could exploit this to extract sensitive database information and potentially disrupt service availability. A patch is not currently available, requiring users to implement alternative mitigations or limit administrative access.

Technical ContextAI

The vulnerability stems from improper input sanitization in SQL queries within the Booking Calendar plugin, a popular WordPress booking management solution. This is a classic CWE-89 SQL Injection vulnerability where user-supplied input is not properly neutralized before being incorporated into SQL commands, allowing attackers to manipulate database queries. The blind SQL injection variant means attackers cannot see direct query results but can infer information through boolean-based or time-based techniques. The affected product is specifically identified as the WPDevelop Booking Calendar plugin for WordPress, though no CPE string is currently available for precise identification.

RemediationAI

Upgrade the Booking Calendar plugin to a version newer than 10.14.15 as soon as a patched version becomes available from WPDevelop. Monitor the WordPress plugin repository or the vendor's website at wpdevelop.com for security updates. As an interim measure, consider implementing Web Application Firewall (WAF) rules to detect and block SQL injection attempts, restrict administrator access to trusted IP addresses only, and enable WordPress database query logging to monitor for suspicious activity. Regular database backups should be maintained in case of compromise.