SQL Injection Vulnerability in WP Booking System Plugin for WordPress

CVE-2026-107712

What is CVE-2026-107712?

The WP Booking System plugin for WordPress has a significant vulnerability that allows authenticated users with subscriber-level access or higher to exploit the 'current_month' parameter through time-based SQL Injection. This occurs due to inadequate escaping of user-supplied input and poorly prepared SQL queries. Consequently, attackers can inject additional SQL commands into existing queries, potentially disclosing sensitive database information. This vulnerability is particularly critical because it represents a regression; a protective capability check was removed in version 2.1, allowing subscriber-level users to access vulnerable functions without nonce validation, increasing the risk of unauthorized data access.

References