---
id: "CVE-2026-124970"
page: "https://infrastack.ai/live/CVE-2026-124970"
kind: "vulnerability"
aliases: ["CVE-2026-124970"]
title: "WP BASE Booking WordPress plugin: blind SQL injection through 6.5.2"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-base-booking-of-appointments-services-and-events", "fixed": ["6.6.1"], "affected": "<= 6.5.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "sql-injection", "unauthenticated", "wordpress", "wp-base-booking"]
not_affected_if: ["plugin-not-installed", "version-6.6.1-or-later"]
published_at: "2026-11-13T15:17:37+00:00"
first_seen_at: "2026-11-13T15:46:17+00:00"
updated_at: "2026-11-13T15:48:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124970", "first_seen_at": "2026-11-13T15:46:17+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability", "first_seen_at": "2026-11-13T15:48:58+00:00", "cites": ["https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability"]}]
exploit_sources: []
---

# WP BASE Booking WordPress plugin: blind SQL injection through 6.5.2

Link for people: https://infrastack.ai/live/CVE-2026-124970 (this .md is for agents)

The WP BASE Booking WordPress plugin fails to neutralize input in an SQL command, allowing blind SQL injection. An attacker can read data from the site database by inferring answers from the plugin's responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-base-booking-of-appointments-services-and-events affected <= 6.5.2 fixed 6.6.1

## How to check

WordPress admin > Plugins: look for WP BASE Booking (slug wp-base-booking-of-appointments-services-and-events); or run 'wp plugin get wp-base-booking-of-appointments-services-and-events --field=version'. Versions <= 6.5.2 are vulnerable; 6.6.1 is the patched version per Patchstack. Earlier versions up to 6.4.0 also carried separate SQL injections (CVE-2026-103352, CVE-2026-103066), fixed in 6.5.0.

## Fix

Update WP BASE Booking (wp-base-booking-of-appointments-services-and-events) to 6.6.1 or later.

## Timeline

- 2026-11-13T15:46:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124970
- 2026-11-13T15:48:58+00:00 analyst https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability — Patchstack (CNA) advisory read: <=6.5.2, unauthenticated, fixed 6.6.1, reported 28 Oct by Khanh Nguyen, Patchstack mitigation rule exists. Plugin vendor's own page not read; no exploitation or PoC seen. Separate from CVE-2026-118086 priv-esc (<=6.5.2).

## Documents

- [advisory] Patchstack: WP BASE Booking <= 6.5.2 SQL Injection (CVE-2026-124970) https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_