What is the CVSS score of EUVD-2026-27548?

EUVD-2026-27548 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Gravity Bookings Premium are affected by EUVD-2026-27548?

Gravity Bookings Premium for WordPress versions 2.5.9 and earlier contain an unauthenticated SQL injection vulnerability (CVSS 7.5) that allows remote attackers to extract sensitive database records…

How to fix or mitigate EUVD-2026-27548?

Within 24 hours: Disable Gravity Bookings Premium plugin if patch is unavailable; identify all WordPress instances running versions ≤2.5.9 via plugin audit. Within 7 days: Contact plugin vendor for patch status and timeline; if patch released, deploy to version 2.6.0 or later immediately across all sites. Within 30 days: Conduct database audit for unauthorized access logs; reset credentials for all affected user accounts; review booking records for data exfiltration indicators.

Gravity Bookings Premium EUVD-2026-27548

| CVE-2026-1719 HIGH

SQL Injection (CWE-89)

2026-05-06 security@wordfence.com

SQLi WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 10:30 vuln.today

DescriptionCVE.org

The Gravity Bookings Premium plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in Gravity Bookings Premium for WordPress (≤2.5.9) allows unauthenticated remote attackers to extract sensitive database information including user credentials, customer data, and booking records. The vulnerability requires no authentication (CVSS PR:N) and has low attack complexity, enabling widespread exploitation. Reported by Wordfence security research; no CISA KEV listing or public exploit code identified at time of analysis, but the trivial exploitation requirements (network accessible, no auth, no user interaction) make this a high-priority patching target for WordPress sites using this booking plugin.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a WordPress plugin's database query handling. The Gravity Bookings Premium plugin fails to properly sanitize user-supplied input parameters before incorporating them into SQL queries, and does not use prepared statements with parameterized queries. WordPress plugins often interact directly with the MySQL/MariaDB database using the wpdb class; when developers concatenate user input into raw SQL strings without escaping, attackers can inject malicious SQL syntax. The CVSS vector AV:N indicates the vulnerable endpoint is accessible over the network (likely an AJAX handler or REST API endpoint that processes booking-related requests), and PR:N confirms no authentication check protects this code path. The Confidentiality impact is High (C:H) while Integrity and Availability remain None, indicating this is a read-only SQL injection suitable for data exfiltration via UNION-based, boolean-based, or time-based blind techniques.

RemediationAI

Upgrade Gravity Bookings Premium to version 2.5.10 or later if available from the vendor at gravitybooking.com (fix version not independently confirmed at time of analysis - verify current patched version with vendor before deployment). If an updated version is not yet released, implement immediate compensating controls: disable the Gravity Bookings Premium plugin entirely until a patch is available, or restrict network access to WordPress admin and AJAX endpoints using WAF rules that block SQL injection patterns in POST/GET parameters (regex patterns for UNION, SELECT, OR 1=1, sleep(), benchmark() functions). Note that signature-based WAF protection may be bypassed by obfuscation techniques; plugin deactivation is the only certain mitigation. For production environments where booking functionality cannot be interrupted, consider moving to an alternative booking plugin temporarily, or place the WordPress installation behind authenticated VPN access to reduce the attack surface from AV:N to AV:A. Monitor WordPress database query logs and web server access logs for suspicious patterns including unusual UNION keywords, comment syntax (--,/**/, #), or time-based payloads in booking-related parameters. Consult Wordfence Threat Intel advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ce032abe-ee9d-4be1-ac97-5fa95d598e85 for additional vendor communication and IOCs.