SQL Injection Vulnerability in WP BASE Booking Plugin by WP BASE
CVE-2026-124970

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
WP Base Booking
Vendor
CVE Published:
13 November 2026

What is CVE-2026-124970?

The WP BASE Booking plugin suffers from a vulnerability that allows attackers to execute Blind SQL Injection attacks. This flaw enables them to manipulate SQL queries, potentially leading to unauthorized access and data leakage. It is crucial for users of WP BASE Booking versions up to 6.5.2 to apply necessary security measures to mitigate risks and safeguard sensitive data.

Affected Version(s)

WP BASE Booking 0 <= 6.5.2

References

https://patchstack.com/database/wordpress/plugin/wp-base-...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khanh Nguyen | Patchstack Bug Bounty Program
.