Junglewise Threat Intelligence

CVE-2026-15335: Booking Package SQL injection in email form parameter

CVE-2026-15335 · Severity: high · CVSS 7.5 · Published 2026-07-11

Technologies: Masaakitanaka Booking Package.

Executive brief

The Booking Package plugin for WordPress, which is used to manage appointments and reservations, contains a security flaw that could allow unauthorized individuals to access sensitive information from the website's database. By sending specially crafted data through a booking form's email field, an attacker can bypass security checks to run unauthorized database commands. While the impact is somewhat mitigated by email format validation, it still poses a risk to data confidentiality.

Technical details

The Booking Package plugin for WordPress is vulnerable to SQL Injection via the 'email' Form Parameter (form<N>) in versions up to and including 1.7.20. This is due to insufficient escaping of user-supplied parameters and a lack of prepared statements in the existing SQL queries. The vulnerability exists in the REST API endpoint '/wp-json/booking-package/v1/request', which is configured with a 'permission_callback' that returns true, allowing unauthenticated access. Because WordPress's 'wp_magic_quotes' does not apply to REST-sourced $_POST values, single quotes reach the SQL sink intact. However, the exploitability is limited because the input must still pass through the 'is_email' validation function.

Affected products

  • masaakitanaka Booking Package up to, and including, 1.7.20

Timeline

  • 2026-07-11: advisory: NVD published the CVE record based on Wordfence data.

References