Booking Manager CVE-2026-91024

Exploitation requires an authenticated WordPress account with Author-level capabilities or higher on a site running Booking Manager before 2.1.21, plus the ability to point the plugin's iCalendar import feature at an attacker-controlled external .ics feed. The core enabling condition is the plugin's external iCalendar feed import functionality being used, since injection occurs when feed field values are passed unsanitized into a SQL query. Limiting factors: the Author-level authentication requirement (not exploitable by anonymous/unauthenticated visitors or Subscriber/Contributor-only accounts) and the need to control or supply the imported feed. No user interaction from a victim is required (UI:N).

This is a genuine but constrained vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N = 6.8) reflects network reach and low attack complexity, but the exploit is fundamentally gated behind authentication: the attacker must already hold at least Author-level access on the target WordPress site. No EPSS score, no CISA KEV listing, and no public POC were provided, so all exploitation signals point to no confirmed real-world abuse. There is no active-exploitation evidence to elevate priority. I disagree with two of the vendor's metric choices: the description says 'Author-level access and above,' which is a low-but-non-trivial privilege and should map to PR:L rather than PR:H, and a SQL injection executing against the plugin's own database (same WordPress DB/security authority) is normally S:U, not S:C - the scope-change is not clearly justified by the description. Also, SQL injection typically permits data modification (I:H) yet the vector marks I:N, so the confidentiality-only impact may understate integrity risk. Net: a real, patch-worthy authenticated SQLi, but not an urgent internet-wide priority given the Author-level precondition and absence of any exploitation telemetry.

An attacker who has obtained Author-level (or higher) credentials on a WordPress site running Booking Manager before 2.1.21 hosts a malicious iCalendar (.ics) feed containing crafted SQL payloads in feed field values. They configure the plugin to import that feed; because the values are used in a SQL query without sanitization or escaping, the injection executes against the site database, enabling extraction of sensitive data. No public exploit code was identified at time of analysis.