EduAdmin Booking CVE-2026-96809

Requires a deployed WordPress site running the EduAdmin Booking plugin (MultiNet Interactive AB) at a version before 6.0.0, with a reachable plugin endpoint that passes attacker-controlled input into a SQL query. Per the supplied CVSS vector no authentication or user interaction is required (PR:N/UI:N), but the description does not confirm the privilege level and provides no specific vulnerable parameter or feature name, so the exact affected request/endpoint and whether a login is needed should be confirmed with the Patchstack advisory. Exploitation is limited to environments where this specific plugin is installed and active, which constrains the realistic attack surface.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3 Critical) describes a network-reachable, low-complexity, unauthenticated blind SQL injection with a scope change and high confidentiality impact - a profile that normally warrants priority patching. However, the corroborating exploitation signals are weak or absent: no EPSS score was provided, the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept is indicated in the single Patchstack reference, so there is no public exploit identified at time of analysis. The PR:N claim comes solely from the vendor-supplied CVSS vector; the description does not state whether a login is required, and many WordPress plugin SQLi flaws are in fact reachable only by authenticated (subscriber/contributor) users, so the unauthenticated assumption should be verified against the Patchstack advisory. The I:N/A:L impact split is consistent with a read-only blind injection rather than data modification. Net: this is a genuinely high-severity vulnerability class (CWE-89) in a reachable web plugin, but the low real-world deployment footprint of this niche booking plugin and the absence of any active-exploitation or POC evidence place it below internet-facing, KEV-listed criticals in urgency - patch promptly where the plugin is installed, but it is not a drop-everything emergency across the broader fleet.

A remote attacker sends crafted HTTP requests to a vulnerable EduAdmin Booking endpoint, injecting SQL payloads into a parameter that is concatenated into a database query. Because the injection is blind, the attacker uses boolean or time-based inference to extract WordPress user credentials, booking records, and other database contents row by row. No public exploit code is identified at time of analysis, and the per-CVSS vector indicates no user interaction is required.