EduAdmin Booking WordPress plugin: Blind SQL injection
Summary
The EduAdmin Booking WordPress plugin by MultiNet Interactive AB contains a blind SQL injection vulnerability in versions before 6.0.0. An unauthenticated remote attacker can send crafted requests to the booking pages to read database contents, such as customer and booking data. No login or user interaction is required, and the CVSS score is 9.3 (critical), but the exact scope of affected versions is disputed between sources.
Affected
- EduAdmin Booking WordPress plugin (slug eduadmin-booking) before 6.0.0 (CNA and NVD range)
- VulDB describes the range as up to 5.x (conflicting information)
Fixed in
- Version 6.0.0 (WordPress.org changelog, 2026-09-04)
- The changelog does not name SQL injection; the fix is confirmed only by third-party trackers.
Workaround
- Unknown. No vendor-verified workaround found.
- General hardening: restrict the application server's access to internal resources and limit outbound database connections to necessary hosts.
- Check with the customer whether the plugin can be disabled without losing bookings.
Exploitation
- Not listed in CISA KEV. EPSS 0.00243 (0%).
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found. No known exploitation in the wild in the sources checked.
- Patchstack rates the issue as high priority and expects exploitation.
Our recommendation
- Identify all WordPress sites running EduAdmin Booking and check the installed version.
- Update to version 6.0.0 or later and verify the version afterwards.
- Review web and database logs for unusual queries against booking pages since early September 2026.
- Confirm the fix status with MultiNet or the Patchstack advisory, as no vendor advisory was found.
- Note that CVE-2026-62101 (broken authentication, versions 5.4.2 and earlier) is also present in these versions, so upgrade urgently.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Rapid7 vulnerability database www.rapid7.com
- Vulners (Rapid7 record) vulners.com
- WordPress.org plugin page wordpress.org
- VulDB entry vuldb.com
- Strix CVE details www.strix.ai
- The Hacker Wire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:45.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.