EUVD-2026-43143
GHSA-3h3p-33f5-225r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint (PR:N/AV:N), but the is_email() filter forces constrained payloads (AC:H) and severely limits data extraction (C:L); no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint /wp-json/booking-package/v1/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer masaakitanaka) lets remote attackers append SQL to an existing query via the 'email' form parameter on the /wp-json/booking-package/v1/request REST endpoint, enabling extraction of sensitive database contents. The endpoint is registered with permission_callback __return_true and REST-sourced $_POST values bypass wp_magic_quotes, so single quotes reach the SQL sink without authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Reachable against default installations because the /wp-json/booking-package/v1/request REST endpoint is registered with permission_callback: __return_true (no authentication, nonce, or capability check) and REST $_POST values skip wp_magic_quotes escaping, so a single quote in the 'email' field reaches the SQL query. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) rates this High on the basis of unauthenticated network reachability and high confidentiality impact, and the unauthenticated REST endpoint is confirmed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted POST request to /wp-json/booking-package/v1/request with a malicious 'email' form parameter that passes is_email() format checks yet embeds appended SQL, aiming to read data such as user records or credentials from the WordPress database. Given AV:N/AC:L reachability the request needs no authentication or user interaction, but the is_email() filter forces the attacker into a heavily constrained payload, limiting what can realistically be exfiltrated; no public proof-of-concept is currently identified. |
| Remediation | Upgrade to the first Booking Package release published after 1.7.20 that incorporates the referenced trac changeset (3602166); an upstream fix is available per the WordPress.org changeset but a specific tagged patched version is not independently confirmed from the provided data, so verify the fixed version on the plugin's WordPress.org page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc86a29-cb1f-4711-925c-51dbbf682477?source=cve) before relying on it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Booking Package
View allThe Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's bookin
Unauthenticated broken access control in the SaaSProject Booking Package WordPress plugin versions 1.7.06 and earlier al
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 all
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today