WP BASE Booking WordPress plugin: Blind SQL injection
Summary
The WordPress plugin WP BASE Booking for online appointments, services and events, versions up to and including 6.4.0, contains a blind SQL injection flaw. An unauthenticated remote attacker can send crafted requests to read, modify or delete database content, including user accounts and customer data. No login or user interaction is required, and the public booking pages make such installations reachable from the internet.
Affected
- WP BASE Booking WordPress plugin (slug wp-base-booking-of-appointments-services-and-events), versions up to and including 6.4.0
- Versions 6.3.1 and earlier are also affected by other critical flaws in the same plugin (CVE-2026-61962), so update to the latest release
Fixed in
- Version 6.5.0 or later (per the CVE record and the Patchstack advisory). Verify against the plugin changelog before relying on it.
Workaround
- No vendor workaround published.
- Patchstack reports a mitigation rule that blocks attacks until the update is applied. Check whether it is active for your sites.
- If the update cannot be applied quickly, deactivate the plugin or apply a Web Application Firewall rule against SQL injection.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV. No public proof of concept found.
- Patchstack rates it as high priority and expects exploitation in mass campaigns.
Our recommendation
- Inventory all WordPress sites and record whether the WP BASE Booking plugin is installed and which version.
- Update the plugin to 6.5.0 or later immediately; if possible, install the latest release.
- If the update is delayed, deactivate the plugin or enable a WAF rule.
- Review web server and database logs for SQL injection patterns and check for unexpected administrator accounts.
- If data exposure is confirmed, assess notification duties under the Swiss FADP.
- Re-check the Patchstack page and NVD once their analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WP BASE Booking <= 6.4.0 SQL Injection patchstack.com
- Strix CVE record CVE-2026-103352 www.strix.ai
- OffSeq Radar: CVE-2026-103352 radar.offseq.com
- HOL Guard: CVE-2026-103352 WP BASE Booking 6.4.0 SQL injection hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:25.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.