PT-2026-97193 · WordPress · Booking Manager

Mohamed Bassia

·

CVE-2026-91024

·

Published

2026-09-23

·

Updated

2026-09-23

CVSS v3.1

6.8

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Booking Manager WordPress plugin versions prior to 2.1.21
Description Authenticated users with Author-level access and above can perform SQL injection attacks. This occurs because the plugin fails to sanitize and escape values retrieved from an external iCalendar feed before incorporating them into a SQL query. An attacker can exploit this by importing a feed under their control.
Recommendations Update Booking Manager WordPress plugin to version 2.1.21 or later.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-91024

Affected Products

Booking Manager