CVE-2026-2508 describes a time-based SQL Injection vulnerability in the GravityMore Gravity Bookings WordPress plugin affecting all versions up to and including 2.7.1. The issue arises from improper neutralization of special elements in the 'staff_id' parameter, allowing authenticated attackers with low privileges (Subscriber-level and above) to append malicious SQL queries to existing database queries. This vulnerability is due to insufficient escaping of user input and lack of prepared statements, enabling extraction of sensitive information from the database. No known exploits are reported in the wild, and no vendor-provided remediation or patch is currently documented.

An attacker with Subscriber-level access or higher can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the plugin's database. The vulnerability does not affect availability or integrity but compromises confidentiality. The CVSS 3.1 base score of 6.5 reflects a medium severity impact with network attack vector, low attack complexity, and privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to minimize exposure and monitor for suspicious activity related to the 'staff_id' parameter. Avoid granting Subscriber-level access to untrusted users. Follow vendor updates for any forthcoming patches or official mitigations.