Gravity Forms Bookings Premium
Monthly
SQL injection exploitable by authenticated subscribers in Gravity Forms Bookings Premium versions through 2.1 enables remote database extraction from affected WordPress installations. The CVSS 8.5 rating reflects network accessibility, low attack complexity, subscriber-level privilege requirements, and a scope change that extends confidentiality impact to the underlying database layer beyond the plugin itself. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege threshold significantly broadens the realistic attacker pool on sites with open user registration.
SQL injection exploitable by authenticated subscribers in Gravity Forms Bookings Premium versions through 2.1 enables remote database extraction from affected WordPress installations. The CVSS 8.5 rating reflects network accessibility, low attack complexity, subscriber-level privilege requirements, and a scope change that extends confidentiality impact to the underlying database layer beyond the plugin itself. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege threshold significantly broadens the realistic attacker pool on sites with open user registration.