CVE-2026-103352: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WP BASE WP BASE Booking

This vulnerability in WP BASE Booking (wp-base-booking-of-appointments-services-and-events) is due to improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. The flaw allows remote attackers with no privileges or user interaction to execute crafted SQL queries that can disclose sensitive information (confidentiality impact) and cause partial denial of service (availability impact). The CVSS 3.1 score is 9.3, reflecting critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the database (high confidentiality impact) and partial disruption of service (low availability impact). There is no indication of integrity impact. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor the vendor's security advisories for updates and apply patches once available. Until then, consider restricting access to the affected plugin or implementing web application firewall rules to detect and block SQL injection attempts.