Gravity Forms Bookings CVE-2026-32466

Exploitation requires the attacker to hold a subscriber-level (or higher) WordPress account on the target site - the lowest authenticated role, commonly obtainable via self-registration on sites that permit it. The target site must have the Gravity Forms Bookings Premium plugin by WPExperts installed, activated, and running version 2.1 or earlier. No additional special configuration or non-default settings are indicated by the available data beyond the plugin being active. Exploitation is bounded by the requirement for any authenticated session; unauthenticated visitors cannot trigger the vulnerability. Sites that have disabled user registration and contain no untrusted subscriber accounts face significantly reduced real-world exposure, though insider or compromised-account scenarios still apply.

The CVSS 8.5 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) presents a combination of signals that constitute an elevated but contextually bounded risk: the network attack vector and low complexity make exploitation straightforward for any authenticated subscriber, while the scope change and C:H confidentiality impact indicate the potential for full database read access - exposing password hashes, PII, API keys, and booking records. No EPSS score was included in the source data, and this CVE does not appear in the CISA KEV catalog, nor is any public proof-of-concept reported, which moderates the immediacy of widespread exploitation risk. However, the PR:L prerequisite - a subscriber account freely obtainable via self-registration on many WordPress sites - means that even a mid-sized municipal IT team in koszalin running a community booking portal should treat this as urgent, since clearing the privilege bar is trivial on most default WordPress deployments. The I:N and A:L ratings confirm this is primarily a data-theft vector rather than a destructive or availability-focused one, which may influence triage prioritization for response teams.

An attacker registers or otherwise obtains a subscriber-level WordPress account on a target site running Gravity Forms Bookings Premium 2.1 or earlier, then submits a crafted HTTP request embedding a SQL injection payload through the vulnerable booking query parameter. The injected SQL executes within the database context, returning arbitrary table contents - including wp_users credential hashes, stored PII, and booking transaction records - to the attacker. No public proof-of-concept has been identified at time of analysis, but the low complexity rating and subscriber-level access requirement make independent exploit development accessible to moderately skilled attackers.