CVE-2026-103066: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WP BASE WP BASE Booking

The WP BASE Booking plugin (versions >=0 and <6.5.0) contains an improper neutralization of special elements in SQL commands, resulting in a Blind SQL Injection vulnerability. This flaw allows an attacker with low privileges to inject SQL commands that can compromise confidentiality with no user interaction required. The CVSS 3.1 score is 8.5, reflecting high impact on confidentiality and limited impact on availability, with network attack vector and low attack complexity.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). Integrity is not impacted, and availability impact is low. The attacker requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor WP BASE vendor channels for updates. Until a fix is available, consider restricting access to the plugin functionality and applying web application firewall rules to detect and block SQL injection attempts targeting this plugin.