CVE-2026-107712 in WP Booking System Plugin
Summary
by MITRE • 10/10/2026
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The WP Booking System – Booking Calendar plugin for WordPress contains a critical time-based SQL injection vulnerability affecting all versions up to and including 2.1.0.1. This flaw resides within the handling of the current_month parameter, which is processed without sufficient input sanitization or proper query preparation mechanisms. The absence of robust escaping procedures allows malicious actors to inject arbitrary SQL commands directly into database queries executed by the application logic. Because this vulnerability relies on time-based blind techniques, attackers can exploit delays in database responses to infer data character by character, enabling them to extract sensitive information from the underlying MySQL database without triggering immediate error messages that might alert administrators or intrusion detection systems.
The operational impact of this vulnerability is significant due to its accessibility profile and the nature of the regression involved. While SQL injection typically requires high-level privileges in many contexts, this specific flaw allows authenticated attackers with subscriber-level access and above to exploit the issue. Subscriber accounts are among the lowest privilege levels on a standard WordPress installation, making it relatively easy for malicious users or compromised low-privilege accounts to initiate attacks. The vulnerability is classified as a regression because a security capability check was previously introduced in versions 2.0.19.11 through 2.0.19.14 specifically to mitigate CVE-2024-50425. However, this protective measure was inadvertently removed during the development of version 2.1, leaving a known attack vector open again without any nonce validation or additional access controls to prevent unauthorized query manipulation.
From a technical classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is associated with ATT&CK technique T1059.007 Command and Scripting Interpreter via SQL injection patterns. The lack of prepared statements means that user-supplied input is concatenated directly into the query string, bypassing any intended logical boundaries. This allows attackers to append additional queries such as UNION SELECT statements or boolean-based conditions that manipulate database behavior based on time delays. The exploitation does not require complex authentication bypasses beyond valid login credentials at the subscriber level, nor does it rely on cross-site request forgery protections since nonce validation is absent for this specific handler endpoint.
Mitigation strategies must address both immediate remediation and long-term security hygiene. Users running affected versions should immediately upgrade to a patched version of the WP Booking System plugin where these regression issues have been resolved and proper input validation has been restored. In scenarios where upgrading is not immediately feasible, administrators can implement web application firewall rules to detect and block SQL injection patterns targeting the current_month parameter. Additionally, enforcing strict role-based access controls ensures that only trusted users with elevated privileges interact with booking management interfaces, reducing the attack surface available to lower-privilege accounts. Regular security audits of plugin code changes are essential to prevent similar regressions where critical security patches are inadvertently removed during subsequent updates.