CVE-2026-124415: WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Q: Which installations should be prioritized for remediation?

Any WordPress installation using the Alex Reservations plugin at version 2.4.8 or an earlier affected version should be treated as exposed. The issue is rated critical with a 9.3 severity score and can be exploited remotely without authentication or user interaction.

Q: What does an attacker need to exploit this issue?

The supplied vector indicates network access is sufficient, with low attack complexity. No privileges or user interaction are required.

Q: What impact could successful exploitation have?

Successful SQL injection may allow high-impact disclosure of confidential data and has a low availability impact. The provided vector does not indicate an integrity impact.

Q: How can I determine whether my site is affected?

Check whether the WordPress site has the Alex Reservations plugin installed and identify its installed version. Versions through 2.4.8 are listed as affected.

Published Nov 13, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

Affected Software

1 affected component

wordpress/alex-reservations<=2.4.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.9

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be prioritized for remediation?

Any WordPress installation using the Alex Reservations plugin at version 2.4.8 or an earlier affected version should be treated as exposed. The issue is rated critical with a 9.3 severity score and can be exploited remotely without authentication or user interaction.

What does an attacker need to exploit this issue?

The supplied vector indicates network access is sufficient, with low attack complexity. No privileges or user interaction are required.

What impact could successful exploitation have?

Successful SQL injection may allow high-impact disclosure of confidential data and has a low availability impact. The provided vector does not indicate an integrity impact.

How can I determine whether my site is affected?

Check whether the WordPress site has the Alex Reservations plugin installed and identify its installed version. Versions through 2.4.8 are listed as affected.

CVE-2026-124415: WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations should be prioritized for remediation?

What does an attacker need to exploit this issue?

What impact could successful exploitation have?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations should be prioritized for remediation?

What does an attacker need to exploit this issue?

What impact could successful exploitation have?

How can I determine whether my site is affected?