Booknetic WordPress plugin: Blind SQL injection

Summary

The Booknetic booking plugin for WordPress is affected by a blind SQL injection vulnerability (CVE-2026-39746) with a CVSS score of 9.3 (Critical). The flaw can be exploited without authentication, so an attacker who can reach the website may be able to read, modify or delete database content, including customer data and WordPress user accounts. The Patchstack advisory rates it as high priority and expects exploitation, but no confirmed exploitation was found in the sources reviewed.

Affected

• Booknetic WordPress plugin, versions before the fixed release (see Fixed)
• Sources conflict on the affected range: the CVE data states before 5.10.3, an OpenCVE mirror states before 5.10.4, and derived descriptions mention 4.8.5 and earlier
• Required privilege: none (unauthenticated)

Fixed in

• Update to 5.10.3 or later, as stated by the CVE data and the Patchstack advisory
• Unverified: an OpenCVE mirror lists 5.10.4 as the fixed version. Confirm the correct release against the vendor changelog before rollout

Workaround

• No vendor workaround found.
• Until a verified fixed version is installed: deactivate the plugin if it is not business-critical, or place a web application firewall in front of its endpoints.
• Restrict database privileges of the WordPress database user.

Exploitation

• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
• Not listed as known exploited (CISA KEV) in the sources reviewed; the snapshots date from early October 2026.
• Patchstack states it is expected to become exploited and is used in mass-exploit campaigns.
• No public proof of concept found.

Our recommendation

• Identify all WordPress sites running Booknetic and update immediately to a release confirmed against the vendor changelog.
• If an update is not possible at once, deactivate the plugin or apply WAF rules.
• Review web and database logs for anomalous requests to Booknetic endpoints since 6 October 2026.
• If compromise is suspected, rotate database and WordPress credentials.
• Also check for CVE-2026-25439 (authentication bypass in Booknetic up to 4.8.5) and patch both together.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory (linked in CVE data) patchstack.com
• Strix CVE-2026-39746 www.strix.ai
• HOL CVE-2026-39746 hol.org
• OpenCVE mirror (conflicting fixed version) app.opencve.io
• CVE Brief archive 2026/10/06 cvebrief.com
• Strix CVE-2026-25439 (related Booknetic flaw) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:22.