Field brief
WP BASE Booking plugin vulnerable to critical blind SQL injection
CVE‑2026‑124970 exposes WP BASE Booking plugin to a high‑severity SQL injection; update to 6.5.3 or later to mitigate.
During the 2026‑11‑13‑14 window, the NVD identified CVE‑2026‑124970 as a critical blind SQL injection in the WP BASE Booking plugin for WordPress. See the NVD record here: CVE‑2026‑124970. The vulnerability allows an attacker to inject SQL commands by improperly neutralizing special elements, potentially extracting data from the database. Affected versions include all releases up to 6.5.2, with no vendor advisory issued and no evidence of active exploitation. The CVSS score of 9.3 underscores the high risk. WordPress site owners using WP BASE Booking should immediately upgrade to the latest plugin release (6.5.3 or newer) or apply the vendor’s patch if available. Regularly review the NVD and vendor advisories for updates, and consider implementing input validation or a web application firewall to mitigate similar injection risks. This vulnerability is listed in the NVD but has not yet been patched by the vendor.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.