CVE-2026-15335

Name of the Vulnerable Software and Affected Versions Booking Package versions prior to 1.7.21

Description Insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow unauthenticated attackers to perform SQL Injection. This occurs via the email parameter in the REST API endpoint '/wp-json/booking-package/v1/request'. Because the endpoint is registered with permission callback: return true and wp magic quotes does not apply to REST-sourced $ POST values, single quotes in the payload can reach the SQL sink. This could allow the extraction of sensitive information from the database, although the impact is limited as the parameter is processed by is email().

Recommendations Update to a version newer than 1.7.20. Avoid using the email parameter in the '/wp-json/booking-package/v1/request' endpoint until the update is applied.