CVE-2026-1719: SQL Injection in Gravity Bookings
Platform
wordpress
Component
gf-bookings-premium
Fixed in
2.6
CVE-2026-1719 describes a SQL Injection vulnerability discovered in Gravity Bookings Premium, a plugin for WordPress. This flaw allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized data extraction. The vulnerability affects versions of Gravity Bookings Premium up to and including 2.5.9. A fix is available in version 2.6.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-1719 could allow an attacker to bypass authentication and directly query the WordPress database. This could result in the theft of sensitive information such as user credentials (usernames and passwords), customer data (names, addresses, payment information), booking details, and potentially even administrative configurations. The attacker could also modify or delete data within the database, leading to data integrity issues and service disruption. Given the widespread use of WordPress and Gravity Bookings, a successful attack could have a significant blast radius, impacting numerous websites and their users.
Exploitation Context
CVE-2026-1719 was published on May 5, 2026. Severity is currently assessed as HIGH (CVSS 7.5). Public proof-of-concept (POC) code is likely to emerge given the ease of SQL injection exploitation. While no active campaigns have been publicly reported as of this writing, the vulnerability's ease of exploitation makes it a potential target for automated scanning and exploitation tools. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
Threat Intelligence
Exploit Status
EPSS
0.08% (24% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-1719 is to immediately upgrade Gravity Bookings Premium to version 2.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious SQL injection attempts targeting the vulnerable parameter. Specifically, look for unusual characters or SQL keywords in user input. Additionally, review and harden database user permissions to limit the potential damage from a successful injection. After upgrading, verify the fix by attempting a SQL injection attack on the vulnerable endpoint and confirming that the attack is blocked.
How to fix
Update to version 2.6, or a newer patched version
Frequently asked questions
What is CVE-2026-1719 — SQL Injection in Gravity Bookings?
CVE-2026-1719 is a SQL Injection vulnerability affecting Gravity Bookings Premium for WordPress versions up to 2.5.9. It allows attackers to inject malicious SQL code to extract sensitive data from the database.
Am I affected by CVE-2026-1719 in Gravity Bookings?
You are affected if you are using Gravity Bookings Premium for WordPress version 2.5.9 or earlier. Check your plugin version using wp plugin list.
How do I fix CVE-2026-1719 in Gravity Bookings?
Upgrade Gravity Bookings Premium to version 2.6 or later. If immediate upgrade is not possible, implement WAF rules to filter SQL injection attempts.
Is CVE-2026-1719 being actively exploited?
While no active campaigns have been publicly reported, the vulnerability's ease of exploitation makes it a potential target. Monitor security advisories and threat intelligence feeds.
Where can I find the official Gravity Bookings advisory for CVE-2026-1719?
Refer to the official Gravity Bookings website and WordPress plugin repository for the latest security updates and advisories related to CVE-2026-1719.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...