CVE-2026-1719 is an SQL Injection vulnerability in the Gravity Bookings Premium WordPress plugin (versions up to 2.5.9). The issue arises from insufficient escaping of user input and the absence of prepared statements in SQL queries, enabling unauthenticated attackers to inject additional SQL commands. This can lead to unauthorized disclosure of sensitive data stored in the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No vendor advisory or patch information is currently available, and the plugin is not a cloud service.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the backend database. The vulnerability impacts confidentiality but does not affect integrity or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting access to it to mitigate risk. Avoid exposing the plugin to untrusted users. Monitor official GravityMore channels for updates.