{"id":"CVE-2026-124970","kind":"vulnerability","aliases":["CVE-2026-124970"],"related":[],"title":"WP BASE Booking WordPress plugin: blind SQL injection through 6.5.2","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2.","summary":"The WP BASE Booking WordPress plugin fails to neutralize input in an SQL command, allowing blind SQL injection. An attacker can read data from the site database by inferring answers from the plugin's responses.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-base-booking-of-appointments-services-and-events","fixed":["6.6.1"],"affected":"<= 6.5.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","sql-injection","unauthenticated","wordpress","wp-base-booking"],"not_affected_if":["plugin-not-installed","version-6.6.1-or-later"],"how_to_check":"WordPress admin > Plugins: look for WP BASE Booking (slug wp-base-booking-of-appointments-services-and-events); or run 'wp plugin get wp-base-booking-of-appointments-services-and-events --field=version'. Versions <= 6.5.2 are vulnerable; 6.6.1 is the patched version per Patchstack. Earlier versions up to 6.4.0 also carried separate SQL injections (CVE-2026-103352, CVE-2026-103066), fixed in 6.5.0.","fix":"Update WP BASE Booking (wp-base-booking-of-appointments-services-and-events) to 6.6.1 or later.","status":"open","published_at":"2026-11-13T15:17:37+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:48:01+00:00","updated_at":"2026-11-13T15:48:58+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T15:48:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP BASE Booking WordPress plugin: blind SQL injection through 6.5.2","impact":"high","summary":"The WP BASE Booking WordPress plugin fails to neutralize input in an SQL command, allowing blind SQL injection. An attacker can read data from the site database by inferring answers from the plugin's responses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-base-booking"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads site database contents through blind SQL injection","analyst_note":"Confirm the fixed version and whether the flawed endpoint requires authentication, using the NVD entry or the plugin vendor's advisory.","how_to_check":"- Check whether the `wp-base-booking-of-appointments-services-and-events` plugin is installed on the WordPress site.\n- Check the installed plugin version; versions through `6.5.2` are affected per the sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"WordPress sites running the WP BASE Booking plugin at version 6.5.2 or earlier. The sources do not describe which settings or user roles are needed to reach the flawed code, so the exposure of any given site is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4568,"output_tokens":507,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the flawed endpoint requires authentication, using the NVD entry or the plugin vendor's advisory.","search":"'-124970':13A,16A '-2026':12A,15A '6.5.2':10A,111C 'affect':104C 'allow':50B,99C 'and':24A 'answer':65B 'appoint':95C 'appointments':22A 'attack':55B 'base':2A,19A,34B,38B,86C,88C,92C,106C 'blind':6A,51B,100C 'book':3A,35B,39B,89C,93C,107C 'booking':20A 'command':49B,80C 'cve':11A,14A 'data':58B 'databas':62B 'element':75C 'event':98C 'events':25A 'fail':42B 'improp':71C 'infer':64B 'inject':8A,29B,53B,82C 'injection.this':102C 'input':45B 'issu':103C 'n/a':109C 'neutral':44B,72C 'of':21A 'packag':26B 'plugin':5A,41B,68B 'read':57B 'respons':70B 'servic':96C 'services':23A 'site':61B 'special':74C 'sql':7A,28B,48B,52B,79C,81C,101C 'sql-inject':27B 'unauthent':30B 'use':76C 'vulner':83C 'wordpress':4A,31B,40B 'wp':1A,18A,33B,37B,85C,87C,91C,105C 'wp-base-book':32B 'wp-base-booking-of-appointments-services-and-ev':90C 'wp-base-booking-of-appointments-services-and-events':17A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WP BASE Booking plugin at version 6.5.2 or earlier. Patchstack lists the required privilege as unauthenticated, so any visitor to the site can attempt it and no login is needed. Sites without this plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T15:48:58Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability","run_id":3888},"how_to_check":{"at":"2026-11-13T15:48:58Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability","run_id":3888},"who_affected":{"at":"2026-11-13T15:48:58Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability","run_id":3888}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpbasebookingofappointmentsservicesandevents"],"ptokens":["and","appointments","base","booking","events","of","services","wp"],"labels":["critical","package","sqlinjection","unauthenticated","wordpress","wpbasebooking"],"campaign_type":null,"search_a":"'-124970':13A,16A '-2026':12A,15A '6.5.2':10A 'and':24A 'appointments':22A 'base':2A,19A 'blind':6A 'book':3A 'booking':20A 'cve':11A,14A 'events':25A 'inject':8A 'of':21A 'plugin':5A 'services':23A 'sql':7A 'wordpress':4A 'wp':1A,18A 'wp-base-booking-of-appointments-services-and-events':17A","search_b":"'allow':50B 'answer':65B 'attack':55B 'base':34B,38B 'blind':51B 'book':35B,39B 'command':49B 'data':58B 'databas':62B 'fail':42B 'infer':64B 'inject':29B,53B 'input':45B 'neutral':44B 'packag':26B 'plugin':41B,68B 'read':57B 'respons':70B 'site':61B 'sql':28B,48B,52B 'sql-inject':27B 'unauthent':30B 'wordpress':31B,40B 'wp':33B,37B 'wp-base-book':32B","search_c":"'6.5.2':111C 'affect':104C 'allow':99C 'appoint':95C 'base':86C,88C,92C,106C 'blind':100C 'book':89C,93C,107C 'command':80C 'element':75C 'event':98C 'improp':71C 'inject':82C 'injection.this':102C 'issu':103C 'n/a':109C 'neutral':72C 'servic':96C 'special':74C 'sql':79C,81C,101C 'use':76C 'vulner':83C 'wp':85C,87C,91C,105C 'wp-base-booking-of-appointments-services-and-ev':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124970","severity":null,"published_at":"2026-11-13T15:17:37+00:00","modified_at":"2026-11-13T15:17:37+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124970:3888","url":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability","severity":null,"published_at":"2026-11-13T15:48:58+00:00","modified_at":"2026-11-13T15:48:58+00:00","first_seen_at":"2026-11-13T15:48:58+00:00","fetched_at":"2026-11-13T15:48:58+00:00","note":"Patchstack (CNA) advisory read: <=6.5.2, unauthenticated, fixed 6.6.1, reported 28 Oct by Khanh Nguyen, Patchstack mitigation rule exists. Plugin vendor's own page not read; no exploitation or PoC seen. Separate from CVE-2026-118086 priv-esc (<=6.5.2).","cites":["https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability"]}],"documents":[{"id":147272,"url":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability","title":"Patchstack: WP BASE Booking <= 6.5.2 SQL Injection (CVE-2026-124970)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}