CVE-2026-91024: Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Author-level access or higher can exploit it. The attacker must be able to import an external iCalendar feed that they control.
Are installations running the fixed plugin version affected?
No. The issue affects Booking Manager versions before 2.1.21; version 2.1.21 is identified as the fixed version.
What component of an imported feed is involved?
The vulnerable value is the iCalendar feed UID, identified as sync_gid. Values from the fetched external feed are used in a SQL query without appropriate sanitization and escaping.