{"id":"CVE-2026-124415","kind":"vulnerability","aliases":["CVE-2026-124415"],"related":[],"title":"Alex Reservations WordPress plugin: SQL injection lets attackers read or change data","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.","summary":"The Alex Reservations plugin by Alejandro Alex has an SQL injection flaw, where input is placed into database queries without proper cleaning. An attacker can use it to read, change or delete data in the site's database.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"alex-reservations","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["alex-reservations","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `alex-reservations` plugin is installed and its version is `2.4.8` or earlier","fix":"- Versions after `2.4.8` are affected or not per the sources; a fixed version is unknown","status":"open","published_at":"2026-11-13T15:17:37+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:48:05+00:00","updated_at":"2026-11-13T15:48:05+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T15:48:05Z","model":"claude-haiku-5-5","output":{"fix":"- Versions after `2.4.8` are affected or not per the sources; a fixed version is unknown","reach":"internet","title":"Alex Reservations WordPress plugin: SQL injection lets attackers read or change data","impact":"high","summary":"The Alex Reservations plugin by Alejandro Alex has an SQL injection flaw, where input is placed into database queries without proper cleaning. An attacker can use it to read, change or delete data in the site's database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","alex-reservations"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or alters the site's database contents","analyst_note":"Confirm the fixed version and whether authentication is required, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124415 and the WordPress plugin page.","how_to_check":"- Check whether the `alex-reservations` plugin is installed and its version is `2.4.8` or earlier\n- unknown","plain_action":"","product_name":"alex-reservations","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Alex Reservations plugin at version 2.4.8 or earlier are affected. The sources do not say whether the flaw needs a logged-in account or a specific plugin setting to be reachable. Sites without this plugin can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000737,"input_tokens":4551,"output_tokens":563,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124415':15A,18A '-2026':14A,17A '2.4.8':95C 'affect':89C 'alejandro':32B,79C 'alex':1A,20A,23B,28B,33B,80C,83C,90C 'alex-reserv':22B,82C 'alex-reservations':19A 'allow':85C 'attack':8A,50B 'chang':11A,56B 'clean':48B 'command':74C 'cve':13A,16A 'data':12A,59B 'databas':44B,64B 'delet':58B 'element':69C 'flaw':38B 'improp':65C 'inject':6A,37B,76C 'injection.this':87C 'input':40B 'issu':88C 'let':7A 'n/a':93C 'neutral':66C 'place':42B 'plugin':4A,30B 'proper':47B 'queri':45B 'read':9A,55B 'reserv':2A,24B,29B,81C,84C,91C 'reservations':21A 'site':62B 'special':68C 'sql':5A,36B,73C,75C,86C 'use':52B,70C 'vulner':77C 'without':46B 'wordpress':3A,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Alex Reservations plugin at version 2.4.8 or earlier are affected. The sources do not say whether the flaw needs a logged-in account or a specific plugin setting to be reachable. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["alexreservations"],"ptokens":["alex","reservations"],"labels":["alexreservations","critical","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-124415':15A,18A '-2026':14A,17A 'alex':1A,20A 'alex-reservations':19A 'attack':8A 'chang':11A 'cve':13A,16A 'data':12A 'inject':6A 'let':7A 'plugin':4A 'read':9A 'reserv':2A 'reservations':21A 'sql':5A 'wordpress':3A","search_b":"'alejandro':32B 'alex':23B,28B,33B 'alex-reserv':22B 'attack':50B 'chang':56B 'clean':48B 'data':59B 'databas':44B,64B 'delet':58B 'flaw':38B 'inject':37B 'input':40B 'place':42B 'plugin':30B 'proper':47B 'queri':45B 'read':55B 'reserv':24B,29B 'site':62B 'sql':36B 'use':52B 'without':46B 'wordpress':26B","search_c":"'2.4.8':95C 'affect':89C 'alejandro':79C 'alex':80C,83C,90C 'alex-reserv':82C 'allow':85C 'command':74C 'element':69C 'improp':65C 'inject':76C 'injection.this':87C 'issu':88C 'n/a':93C 'neutral':66C 'reserv':81C,84C,91C 'special':68C 'sql':73C,75C,86C 'use':70C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124415","severity":null,"published_at":"2026-11-13T15:17:37+00:00","modified_at":"2026-11-13T15:17:37+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}