CVE-2026-124970: WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability

Q: Who can exploit this issue?

The vulnerability has a network attack vector, low attack complexity, and requires no privileges or user interaction. This indicates that an unauthenticated remote attacker may be able to target an affected installation.

Q: Which plugin versions are affected?

WP BASE Booking versions through 6.5.2 are affected. The available information does not identify a fixed version.

Q: What is the potential impact?

The issue is a blind SQL injection vulnerability. The supplied severity vector indicates high confidentiality impact and low availability impact, with scope changed; no integrity impact is indicated.

Published Nov 13, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2.

Affected Software

1 affected component

WP BASE WP BASE Booking<=6.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/wp-base-booking-of-appointments-services-and-events to a version that resolves this vulnerability.
Fixed in 6.6.1

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability has a network attack vector, low attack complexity, and requires no privileges or user interaction. This indicates that an unauthenticated remote attacker may be able to target an affected installation.

Which plugin versions are affected?

WP BASE Booking versions through 6.5.2 are affected. The available information does not identify a fixed version.

What is the potential impact?

The issue is a blind SQL injection vulnerability. The supplied severity vector indicates high confidentiality impact and low availability impact, with scope changed; no integrity impact is indicated.

CVE-2026-124970: WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the potential impact?