What is the CVSS score of CVE-2026-54820?

CVE-2026-54820 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of JetBooking are affected by CVE-2026-54820?

The JetBooking WordPress plugin (versions ≤4.0.4.1) contains an unauthenticated SQL injection vulnerability enabling remote attackers to access and exfiltrate the entire WordPress database without…

How to fix or mitigate CVE-2026-54820?

Within 24 hours: Audit all WordPress deployments to identify JetBooking installations and document versions; flag any instance running 4.0.4.1 or earlier as at-risk. Within 7 days: Implement interim controls-deploy WAF rules blocking SQL injection patterns in JetBooking request handlers, restrict plugin access to authenticated users via security plugins or .htaccess, and enable database query logging with alerts. Within 30 days: Monitor official JetBooking and Patchstack channels for patch release; deploy immediately upon availability. If no patch emerges within 30 days, plan plugin removal or replacement.

JetBooking CVE-2026-54820

EUVD-2026-39783 CRITICAL

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-xqjr-4848-35gg

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality disclosure; scope changed as the DB is a separate component, with no integrity change and only low availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:33 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.

AnalysisAI

Unauthenticated SQL injection in the JetBooking WordPress plugin (versions 4.0.4.1 and earlier) lets remote attackers inject crafted SQL into a vulnerable query without any login, exposing the WordPress database. Reported by Patchstack with a CVSS 9.3 (scope-changed, high confidentiality impact), the flaw allows extraction of sensitive data such as user credentials and booking records. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

JetBooking is a Crocoblock commercial booking/reservation plugin for WordPress that integrates with JetEngine and Elementor to manage appointments, availability calendars, and booking records stored in the WordPress (MySQL/MariaDB) database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a database query without adequate sanitization or parameterized binding. Because WordPress plugins typically build queries against the shared $wpdb connection, a single unsanitized parameter can expose the entire site database, including wp_users credential hashes and any custom booking tables the plugin creates.

RemediationAI

Update the JetBooking plugin to the latest available release beyond 4.0.4.1 - the input does not specify an exact fixed version, so treat the upgrade as 'No vendor-released patch version independently confirmed at time of analysis' and verify the patched build via the Crocoblock account/changelog and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-0-4-1-sql-injection-vulnerability?_s_id=cve before relying on it. Until a confirmed fixed version is installed, place the site behind a WAF with SQL-injection signatures (Patchstack and most WordPress WAFs ship a virtual patch for this CVE) to filter malicious query strings; the trade-off is that WAF rules are bypassable and add request latency. As a stronger but more disruptive control, deactivate the JetBooking plugin until patched - this removes the attack surface entirely but takes booking functionality offline. Additionally, restrict the database account used by WordPress to least privilege and ensure backups are current, though these limit blast radius rather than preventing the injection.