CVE-2026-39746
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Booknetic plugin is vulnerable to SQL Injection (improper neutralization of special elements in SQL commands), allowing an attacker to perform Blind SQL Injection. This issue affects versions before 5.10.3.
Risk Assessment
An attacker could exploit this vulnerability to extract sensitive data from the database, potentially leading to information disclosure. However, it requires interaction with the application and may be difficult to detect.
Recommendation
Update the Booknetic plugin to version 5.10.3 or later to eliminate the vulnerability.
Other vulnerabilities in Booknetic
See all- CVE-2026-25439High
The Booknetic plugin contains an Authentication Bypass Using an Alternate Path or Channel vulnerability, allowing authentication abuse. This issue affects versions before 5.10.3.
- CVE-2025-26926Medium
The Booknetic plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This affects versions before 5.10.4.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS