---
id: "CVE-2026-124415"
page: "https://infrastack.ai/live/CVE-2026-124415"
kind: "vulnerability"
aliases: ["CVE-2026-124415"]
title: "Alex Reservations WordPress plugin: SQL injection lets attackers read or change data"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "alex-reservations", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["alex-reservations", "other", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:37+00:00"
first_seen_at: "2026-11-13T15:46:17+00:00"
updated_at: "2026-11-13T15:48:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124415", "first_seen_at": "2026-11-13T15:46:17+00:00"}]
exploit_sources: []
---

# Alex Reservations WordPress plugin: SQL injection lets attackers read or change data

Link for people: https://infrastack.ai/live/CVE-2026-124415 (this .md is for agents)

The Alex Reservations plugin by Alejandro Alex has an SQL injection flaw, where input is placed into database queries without proper cleaning. An attacker can use it to read, change or delete data in the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:alex-reservations affected range not listed fixed no fixed version listed

## How to check

- Check whether the `alex-reservations` plugin is installed and its version is `2.4.8` or earlier

## Fix

- Versions after `2.4.8` are affected or not per the sources; a fixed version is unknown

## Timeline

- 2026-11-13T15:46:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124415

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_