SQL Injection Vulnerability in WP Booking System Plugin for WordPress

CVE-2026-111178

What is CVE-2026-111178?

The WP Booking System plugin for WordPress is susceptible to a SQL injection vulnerability via the 'data[orderby]' parameter in all versions up to and including 2.1.0.1. This issue arises from inadequate input sanitization and improper handling of SQL queries, allowing authenticated users with administrator privileges to inject arbitrary SQL code. Successful exploitation requires that the targeted booking calendar has over 200 entries, facilitating the execution of additional SQL queries through the AJAX handler when the use_ajax branch is invoked. This vulnerability poses a risk of unauthorized access to sensitive database information, underscoring the importance of promptly updating the plugin to mitigate potential threats.

References