Is CVE-2026-15335 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15335 being exploited in the wild.

How severe is CVE-2026-15335?

High severity, with a CVSS score of 7.5, published 11 July 2026.

Which products and versions are affected?

masaakitanaka Booking Package up to, and including, 1.7.20.

Is there a fix for CVE-2026-15335?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15335 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15335?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15335: Booking Package SQL injection in email form parameter

CVE-2026-15335 · Severity: high · CVSS 7.5 · Published 2026-07-11

The Booking Package plugin for WordPress, which is used to manage appointments and reservations, contains a security flaw that could allow unauthorized individuals to access sensitive information from the website's database. By sending specially crafted data through a booking form's email field, an attacker can bypass security checks to run unauthorized database commands. While the impact is somewhat mitigated by email format validation, it still poses a risk to data confidentiality.

Quick answers

Is CVE-2026-15335 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15335 being exploited in the wild.
How severe is CVE-2026-15335?: High severity, with a CVSS score of 7.5, published 11 July 2026.
Which products and versions are affected?: masaakitanaka Booking Package up to, and including, 1.7.20.
Is there a fix for CVE-2026-15335?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15335 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15335?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Booking Package plugin for WordPress is vulnerable to SQL Injection via the 'email' Form Parameter (form<N>) in versions up to and including 1.7.20. This is due to insufficient escaping of user-supplied parameters and a lack of prepared statements in the existing SQL queries. The vulnerability exists in the REST API endpoint '/wp-json/booking-package/v1/request', which is configured with a 'permission_callback' that returns true, allowing unauthenticated access. Because WordPress's 'wp_magic_quotes' does not apply to REST-sourced $_POST values, single quotes reach the SQL sink intact. However, the exploitability is limited because the input must still pass through the 'is_email' validation function.

Affected products

masaakitanaka Booking Package up to, and including, 1.7.20

Timeline

2026-07-11: advisory: NVD published the CVE record based on Wordfence data.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.