ALEX-RESERVATIONS · CVE-2026-124415 · Other
NO FIX YET · SEE WHAT TO DO
The Alex Reservations plugin by Alejandro Alex has an SQL injection flaw, where input is placed into database queries without proper cleaning. An attacker can use it to read, change or delete data in the site's database.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Alex Reservations plugin at version 2.4.8 or earlier are affected. The sources do not say whether the flaw needs a logged-in account or a specific plugin setting to be reachable. Sites without this plugin can skip it.
Not affected if plugin-not-installed
Who cares alex-reservations, wordpress
alex-reservations plugin is installed and its version is 2.4.8 or earlier2.4.8 are affected or not per the sources; a fixed version is unknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.