# CVE-2026-15335: Booking Package SQL injection in email form parameter

Source: https://junglewise.ai/threats/cve-2026-15335-booking-package-sql-injection-in-email-form-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11. Updated: 2026-07-11  
License: CC BY 4.0 with a link back

CVE-2026-15335 · Severity: high · CVSS 7.5 · Published 2026-07-11

The Booking Package plugin for WordPress, which is used to manage appointments and reservations, contains a security flaw that could allow unauthorized individuals to access sensitive information from the website's database. By sending specially crafted data through a booking form's email field, an attacker can bypass security checks to run unauthorized database commands. While the impact is somewhat mitigated by email format validation, it still poses a risk to data confidentiality.

## Quick answers

**Is CVE-2026-15335 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15335 being exploited in the wild.

**How severe is CVE-2026-15335?** High severity, with a CVSS score of 7.5, published 11 July 2026.

**Which products and versions are affected?** masaakitanaka Booking Package up to, and including, 1.7.20.

**Is there a fix for CVE-2026-15335?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15335 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15335?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Booking Package plugin for WordPress is vulnerable to SQL Injection via the 'email' Form Parameter (form<N>) in versions up to and including 1.7.20. This is due to insufficient escaping of user-supplied parameters and a lack of prepared statements in the existing SQL queries. The vulnerability exists in the REST API endpoint '/wp-json/booking-package/v1/request', which is configured with a 'permission_callback' that returns true, allowing unauthenticated access. Because WordPress's 'wp_magic_quotes' does not apply to REST-sourced $_POST values, single quotes reach the SQL sink intact. However, the exploitability is limited because the input must still pass through the 'is_email' validation function.

## Affected products

- masaakitanaka Booking Package up to, and including, 1.7.20

## Timeline

- 2026-07-11: advisory: NVD published the CVE record based on Wordfence data.

## References

- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/index.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/index.php)
- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/index.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/index.php)
- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/lib/Schedule.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/lib/Schedule.php)
- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/lib/Schedule.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.18/lib/Schedule.php)
- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.20/index.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.20/index.php)
- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.20/index.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.20/index.php)
- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.20/lib/Schedule.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.20/lib/Schedule.php)