Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

WP BASE Booking plugin allows SQL injection

CVE-2026-103352 · published 13 days ago
Summary

The WP BASE Booking plugin for WordPress (versions up to 6.4.0) does not properly filter data it sends to its database, making it possible for an attacker to run hidden database commands. This could let a malicious user view, modify, or delete your booking data. Update the plugin to the latest version or apply the vendor’s patch as soon as possible.

What to do
  • Update wp base wp base booking to version 6.5.0.
Affected software
VendorProductAffected versions
wp base wp base booking <= 6.4.0
Fix: upgrade to 6.5.0
Original advisory text
WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-103352 · NVD
CVE-2026-103352 · MITRE
Track software like this
Free during beta