This vulnerability (CVE-2026-32466) is classified as CWE-89, indicating improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects the Gravity Forms Bookings premium plugin by WPExperts, specifically versions 2.1 and earlier. The flaw allows an attacker with network access and low privileges to inject SQL commands, potentially compromising data confidentiality and causing limited availability issues. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to high confidentiality impact, allowing unauthorized disclosure of sensitive data. Integrity impact is not indicated, and availability impact is low, suggesting limited disruption. The attacker requires low privileges and network access but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided.