WordPress Directorist Booking plugin < 3.0.2 - SQL Injection Schwachstelle

Successful exploitation of this SQL Injection vulnerability could allow an attacker to bypass authentication mechanisms, read sensitive data stored in the database (such as user credentials, booking information, and payment details), modify data, or even execute arbitrary commands on the underlying server. The blast radius extends to any data accessible through the Directorist Booking database. A skilled attacker could leverage this to gain complete control of the WordPress site and potentially pivot to other systems on the network. While no specific real-world exploitation has been publicly reported yet, SQL Injection vulnerabilities are consistently among the most exploited web application flaws.

1. Reserviert2026-01-07
2. Veröffentlicht2026-04-27
3. Geändert2026-04-28
4. EPSS aktualisiert2026-05-04

The primary mitigation is to immediately upgrade Directorist Booking to version 3.0.2 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include using a Web Application Firewall (WAF) with SQL Injection rules to filter malicious requests, and carefully reviewing and sanitizing all user inputs to Directorist Booking. Regularly scan your WordPress site for vulnerabilities using a reputable security plugin. After upgrading, confirm the fix by attempting a SQL Injection attack on the vulnerable endpoint (e.g., using a simple ' OR '1'='1 payload) and verifying that it is properly blocked.