SQL Injection Vulnerability in Booking Manager Plugin for WordPress
CVE-2026-91024
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-91024?
The Booking Manager plugin for WordPress prior to version 2.1.21 is susceptible to an SQL injection vulnerability. This occurs due to improper sanitization and escaping of values derived from external iCalendar feeds before they are incorporated into SQL queries. Authenticated users with Author-level access or higher can exploit this vulnerability by importing a maliciously crafted iCalendar feed, allowing them to execute unauthorized SQL commands and potentially manipulate or extract sensitive database information.
Affected Version(s)
Booking Manager 0 < 2.1.21
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.