# CVE-2026-54820: Crocoblock JetBooking unauthenticated SQL injection

Source: https://junglewise.ai/threats/cve-2026-54820-crocoblock-jetbooking-unauthenticated-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-54820 · Severity: critical · CVSS 9.3 · Published 2026-06-26

JetBooking is a WordPress plugin used to manage booking and rental services on websites. A critical security flaw allows unauthorized individuals to send malicious commands to the website's database without needing a login. This could lead to the theft of sensitive customer information, unauthorized access to site data, or disruption of booking services.

Technologies: [Crocoblock JetBooking](https://junglewise.ai/threats/technologies/jetbooking). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-54820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54820 being exploited in the wild.

**How severe is CVE-2026-54820?** Critical severity, with a CVSS score of 9.3, published 26 June 2026.

**Which products and versions are affected?** Crocoblock JetBooking <= 4.0.4.1.

**Is there a fix for CVE-2026-54820?** A patch was published on 2026-06-26: Patch available in version 4.0.4.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54820 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54820?** Check whether you run Crocoblock JetBooking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated SQL injection vulnerability exists in the JetBooking plugin for WordPress (versions <= 4.0.4.1). The flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), allowing a remote attacker to execute arbitrary SQL queries via the network without any prior authentication or user interaction. This can lead to full database compromise, including sensitive data exfiltration. The vulnerability was addressed in version 4.0.4.2.

## Affected products

- Crocoblock. Jetimpex Inc. JetBooking <= 4.0.4.1

## Timeline

- 2026-04-24: other: Vulnerability reported by researcher daroo
- 2026-06-17: advisory: Initial disclosure by Patchstack
- 2026-06-26: disclosed: CVE published to NVD dataset
- 2026-06-26: patched: Patch available in version 4.0.4.2

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-0-4-1-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-0-4-1-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [Crocoblock JetBooking broken access control](https://junglewise.ai/threats/cve-2026-65468-crocoblock-jetbooking-broken-access-control)
- [Crocoblock JetBooking SSRF via Custom Role](https://junglewise.ai/threats/cve-2026-65466-crocoblock-jetbooking-ssrf-via-custom-role)