PT-2026-97193 · WordPress · Booking Manager

Mohamed Bassia

·

CVE-2026-91024

·

تاريخ النشر

2026-09-23

·

تاريخ التحديث

2026-09-23

CVSS v3.1

6.8

متوسطة

المتجهAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Booking Manager WordPress plugin versions prior to 2.1.21
Description Authenticated users with Author-level access and above can perform SQL injection attacks. This occurs because the plugin fails to sanitize and escape values retrieved from an external iCalendar feed before incorporating them into a SQL query. An attacker can exploit this by importing a feed under their control.
Recommendations Update Booking Manager WordPress plugin to version 2.1.21 or later.

استغلال

إصلاح

SQL injection

وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
dbugs@ptsecurity.com

تصنيف نقاط الضعف

CWE-89

المعرّفات ذات الصلة

CVE-2026-91024

المنتجات المتأثرة

Booking Manager