CVE-2026-91024
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query. Authenticated users with Author-level access and above can perform SQL injection attacks by importing a feed they control.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to leakage, modification, or deletion of WordPress database data. The risk includes full compromise of application data.
Recommendation
Update the Booking Manager plugin to version 2.1.21 or later. Restrict the ability to import external iCalendar feeds to trusted sources.
Other vulnerabilities in Booking Manager
See all- CVE-2026-91025Medium
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's plugin-specific settings targets the requesting user's own account. Any authenticated user with subscriber-level access and above can create or overwrite the plugin's per-user settings on arbitrary users, including administrators.
- CVE-2025-64275Medium
The Booking Manager plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Manager versions from n/a through <= 2.1.17.
Original NVD description (English source)
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS