CVE-2026-2508

Name of the Vulnerable Software and Affected Versions Gravity Forms Booking versions prior to 2.7.2

Description Authenticated attackers with Subscriber-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of the user-supplied staff id parameter and a lack of sufficient preparation of the SQL query. This flaw allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update to version 2.7.2 or later. As a temporary mitigation, restrict access to the functionality utilizing the staff id parameter for users with Subscriber-level permissions.