EUVD-2026-93255
GHSA-36mp-hvvf-qhq2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Booknetic ≤4.8.5
-
ExploitSend crafted request to vulnerable booking parameter
-
ExecutionInject SQL via unsanitized input
-
ImpactExtract database contents (users, credentials, PII)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the Booknetic plugin (version 4.8.5 or earlier) installed and active on an internet-reachable WordPress site; per PR:N/UI:N the injection is reachable pre-authentication against a default plugin installation, so any publicly accessible booking page is a candidate. The primary limiting factor is product presence: only sites running this specific plugin at or below 4.8.5 are affected, and exploitation value scales with how much sensitive data the WordPress database holds. No authentication, no user interaction, and no non-default configuration is indicated by the available data. |
| Impact | This is a genuine high-priority issue by its exploitability profile: the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, which for a SQL injection (CWE-89) means any remote actor can query the WordPress database directly. The 9.3 base score is driven largely by the S:C (scope-changed) metric plus C:H; however, the input reports no EPSS probability, no CISA KEV listing, and no public POC, so there is no evidence of active or at-scale exploitation - exploitation likelihood must currently be inferred from the primitive's ease, not from observed telemetry. There is also an internal inconsistency worth flagging: the vendor vector sets I:N and A:L, which is unusual for SQL injection (injection typically threatens integrity via write/stacked queries as well as confidentiality), so the real integrity impact may be understated - verify with Patchstack. Net assessment: treat as a real priority to patch because unauthenticated SQLi in an internet-facing WordPress plugin is readily weaponized, while acknowledging that no confirmed exploitation signal exists yet. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable Booknetic endpoint (e.g., a booking/AJAX parameter) on a WordPress site running version 4.8.5 or earlier, injecting SQL that the plugin passes unsanitized to the database. This lets the attacker extract sensitive data such as user records, session tokens, or password hashes from the WordPress database. No public exploit identified at time of analysis, though the low attack complexity makes exploit development straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated SQL injection in the Booknetic WordPress plugin (versions 4.8.5 and earlier) lets any remote attacker inject arbitrary SQL into database queries handled by the plugin, yielding direct read access to the underlying WordPress database. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), the injection is reachable before authentication against a default plugin installation, so any internet-reachable WordPress site with Booknetic active and a publicly accessible booking page is a viable target - no account, no user interaction, and no non-default configuration required. The practical ceiling on impact is set by product presence: only sites actually running the affected plugin are exposed, and the value of exploitation scales with how much sensitive data the WordPress database holds; no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence, though the reported 9.3 CVSS score and confidentiality-heavy impact justify treating this as a high-priority patch.
RemediationAI
No vendor-released patch was identified in the available intelligence - the only reference supplied is the Patchstack vulnerability database entry, not a fixed-version advisory - so confirm the current Booknetic release against the Patchstack page and upgrade to the first version published above 4.8.5 as soon as it is verified. Until then, the most effective control is to deactivate the Booknetic plugin outright, accepting the loss of booking functionality as the trade-off; if the plugin must stay live, restrict the public booking pages so they are reachable only from trusted networks or behind authentication, and deploy WAF rules that block SQL metacharacter patterns (UNION, OR 1=1, stacked statements, comment sequences) on requests to the plugin's booking, shortcode, and admin-ajax/REST endpoints, understanding that signature-based filtering is evadable and generates false positives on legitimate input. Because the injection requires no credentials, add-ons such as IP allowlisting or CAPTCHA only slow rather than stop an attacker, so prioritize patching; in parallel, review WordPress logs for anomalous plugin-endpoint requests and audit the database for unexpected dump-style query patterns or tampering, since integrity effects cannot be ruled out even though confidentiality is the dominant impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a WordPress plugin. Booknetic is a booking/appointment plugin published under the fs-code vendor namespace (CPE cpe:2.3:a:fs-code:booknetic:*:*:*:*:*:*:*:*), which means the vulnerable code executes inside the WordPress runtime and issues SQL against the site's own wp_* tables through the plugin's request-handling surface (typically shortcode/AJAX or REST handlers backing the public booking pages). Because the plugin builds query strings from user-controllable request parameters without proper parameterization or prepared statements, attacker-supplied input can alter the query's structure, allowing arbitrary SELECT-style data reads and possible manipulation of stored records. Patchstack is credited as the reporting source, and the single reference is the Patchstack vulnerability database entry rather than a vendor changelog; the wildcard CPE gives no version granularity beyond the advisory's stated '<= 4.8.5' ceiling. Note the discrepancy between the supplied vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, score 9.3) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:L/A:N); both agree on network reachability, low attack complexity, no privileges and no user interaction, and both place the primary impact on confidentiality, so the difference is one of scoring spread (scope and the relative weight of integrity/availability) rather than of exploitability.
Know when Booknetic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi gives AV:N/AC:L/PR:N/UI:N with C:H for data disclosure; I:L for possible query-driven writes, A:N and S:N as no cross-component scope break is evidenced.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
Articles & Coverage 1
Executive ViewAI
The Booknetic WordPress plugin (versions 4.8.5 and earlier) contains a critical unauthenticated SQL injection vulnerability that allows any remote attacker to read the underlying WordPress database. Organizations hosting internet-facing WordPress sites with this plugin active are exposed without authentication or user interaction, risking unauthorized disclosure of sensitive data such as customer records or booking information. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should prioritize identifying and mitigating affected sites.
No vendor-released patch identified at time of analysis. Interim mitigations include: deactivating or removing the Booknetic plugin if not business-critical; restricting public access to booking pages via IP allowlisting; deploying WAF rules to block SQL injection attempts against Booknetic endpoints; applying least-privilege database accounts; and enabling enhanced logging and monitoring for suspicious database activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow att
Account takeover in Booknetic WordPress appointment booking plugin versions 4.8.5 and earlier allows remote unauthentica
Exploit-DB