CVE-2026-15335 describes an SQL Injection vulnerability in the masaakitanaka Booking Package WordPress plugin versions up to and including 1.7.20. The vulnerability exists in the REST API endpoint /wp-json/booking-package/v1/request, which accepts an 'email' parameter without proper escaping or prepared statements. The endpoint is registered with a permission callback that always returns true, allowing unauthenticated access. The lack of wp_magic_quotes on REST POST data means single quotes reach the SQL query intact. Although the input is filtered with is_email, this does not fully prevent injection, enabling attackers to append SQL queries and extract sensitive data. No vendor advisory or patch is currently available.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The confidentiality of data is at risk (high impact on confidentiality). Integrity and availability are not impacted according to the provided data. The vulnerability is remotely exploitable without authentication and requires low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the vulnerable REST API endpoint or applying Web Application Firewall (WAF) rules to detect and block SQL Injection attempts targeting the 'email' parameter. Avoid relying solely on is_email filtering as it does not fully mitigate the risk.