CVE-2026-107712: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in murgroland WP Booking System – Booking Calendar

CVE-2026-107712 describes a time-based SQL Injection vulnerability in the WP Booking System – Booking Calendar plugin for WordPress. The flaw exists in the handling of the 'current_month' parameter, which is insufficiently escaped and improperly prepared in SQL queries. Authenticated attackers with subscriber-level privileges can exploit this to append malicious SQL commands, potentially extracting sensitive database information. This vulnerability is a regression caused by the removal of a capability check introduced in versions 2.0.19.11 through 2.0.19.14 that addressed a previous related vulnerability (CVE-2024-50425). The regression means that from version 2.1 onward, the vulnerable code is accessible without nonce validation, increasing the risk of exploitation.

Successful exploitation allows an authenticated user with subscriber-level access or higher to perform time-based SQL Injection attacks, enabling extraction of sensitive information from the database. The vulnerability does not impact availability or integrity but compromises confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

No official patch or fix is currently provided for this vulnerability. Since this is a regression introduced in version 2.1, users should consider downgrading to a non-vulnerable version prior to 2.1.0.1 or applying custom mitigations such as restricting subscriber-level access or implementing additional input validation and query parameterization. Monitor the vendor's advisory channels for any forthcoming official fixes.