Executive brief
The Booking Manager WordPress plugin contains a SQL injection vulnerability in its iCalendar feed import feature. Attackers with Author-level or higher access can inject malicious SQL code through a crafted feed they control, potentially exposing or manipulating sensitive data stored in the WordPress database. This requires attackers to already have legitimate plugin user access to exploit it.
Technical details
The plugin fails to sanitize and escape values extracted from external iCalendar (ICS) feed sources before using them in SQL queries. An authenticated attacker with Author-level access can craft a malicious ICS feed containing SQL injection payloads in the UID/sync_gid field and trigger the vulnerability through the feed import functionality. The attack allows arbitrary SQL query execution within the database context of the WordPress installation.
Affected products
- Booking Manager Booking Manager before 2.1.21
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Fixed in version 2.1.21