CVE-2026-103352
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WP BASE Booking plugin (wp-base-booking-of-appointments-services-and-events) is vulnerable to Blind SQL Injection due to improper neutralization of special elements in an SQL command. The vulnerability affects versions up to 6.4.0.
Risk Assessment
An attacker could exploit blind SQL injection to read data from the database without authorization, potentially leading to data leakage.
Recommendation
Update the plugin to a patched version if available, or apply other mitigations.
Other vulnerabilities in WP BASE Booking
See all- CVE-2026-73402Medium
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
- CVE-2026-61962Critical
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
- CVE-2026-118086High
The WordPress plugin WP BASE Booking in versions up to 6.5.2 contains a privilege escalation vulnerability exploitable by a subscriber-level user. This may lead to elevated privileges within the site.
- CVE-2026-103066High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection. This issue affects WP BASE Booking: from n/a through 6.4.0.
- CVE-2026-59541High
The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.
- CVE-2026-39587High
There is a vulnerability in WP BASE Booking versions up to 5.9.0 that allows unauthenticated privilege escalation.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS