WP BASE Booking: Blind SQL Injection in WordPress plugin
Summary
The WordPress plugin WP BASE Booking up to version 6.4.0 is vulnerable to blind SQL Injection (CWE-89). An authenticated attacker with a low-privilege account, such as a Subscriber, can send crafted input to the database layer and extract data, including customer details, booking information and WordPress user data. Patchstack rates the issue as high priority with a CVSS score of 8.5.
Affected
- WP BASE Booking WordPress plugin, versions up to and including 6.4.0 (per CNA data)
- Unresolved: a third-party database lists the affected range as below 6.5.0; the CNA range was used here.
Fixed in
- Version 6.5.0 or later (per CNA and Patchstack; verify against the plugin's WordPress.org changelog or vendor before rollout)
Workaround
- Unknown. No vendor-confirmed workaround was found.
- Patchstack reports a virtual patch rule that blocks attacks until the plugin is updated, if your WAF or hosting provider offers it.
Exploitation
- Not listed as known exploited (CISA KEV: not listed according to a third-party source).
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Patchstack expects exploitation and notes use in mass-exploit campaigns.
- No public proof of concept found.
Our recommendation
- Inventory all WordPress sites running WP BASE Booking, including staging and forgotten sites.
- Update to version 6.5.0 or later once confirmed; disable the plugin if it is not business-critical and cannot be updated immediately.
- Review accounts with low-privilege roles and remove unused ones.
- Monitor web and database logs for unusual requests to booking endpoints.
- Do not confuse with CVE-2026-103352, the same plugin with a higher score, which requires separate tracking.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Strix CVE details www.strix.ai
- Install Guard CVE-2026-103066 hol.org
- Offseq threat radar radar.offseq.com
- Positive Technologies PT-2026-106169 vulners.com
- Qualys detections October 2026 notifications.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:26.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.