CVE-2026-15335 describes a SQL Injection vulnerability in the Booking Package WordPress plugin (masaakitanaka) affecting all versions up to and including 1.7.20. The vulnerability exists in the REST API endpoint /wp-json/booking-package/v1/request, which accepts an 'email' parameter that is insufficiently sanitized before being used in SQL queries. The endpoint is registered with a permission callback that always returns true, allowing unauthenticated access. Additionally, WordPress magic quotes do not apply to REST POST data, so single quotes in the payload reach the SQL query unescaped. Although the parameter is validated using is_email, this does not fully prevent injection. The CVSS 3.1 score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No patch or official remediation is currently documented.

An unauthenticated attacker can exploit this vulnerability to inject arbitrary SQL commands via the 'email' parameter in the REST API, potentially extracting sensitive information from the database. The confidentiality of data is at risk, but integrity and availability are not impacted. The impact is somewhat limited by the email validation filter, which reduces but does not eliminate the risk of successful exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable REST API endpoint or implementing additional input validation and sanitization at the web application firewall or plugin level to block malicious payloads targeting the 'email' parameter.