CVE-2026-32466

HighCVSS 8.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The Gravity Forms Bookings premium plugin versions up to 2.1 contain a Subscriber SQL Injection vulnerability. An attacker with subscriber privileges can execute unauthorized database queries.

Risk Assessment

The risk includes the possibility of reading, modifying, or deleting database data, which could lead to data integrity compromise and information leakage.

Recommendation

It is recommended to update the Gravity Forms Bookings premium plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.