CVE-2026-1719: SQL Injection in Gravity Bookings
Plateforme
wordpress
Composant
gf-bookings-premium
Corrigé dans
2.6
CVE-2026-1719 describes a SQL Injection vulnerability discovered in Gravity Bookings Premium, a plugin for WordPress. This flaw allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized data extraction. The vulnerability affects versions of Gravity Bookings Premium up to and including 2.5.9. A fix is available in version 2.6.
Détecte cette CVE dans ton projet
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Impact et Scénarios d'Attaquetraduction en cours…
Successful exploitation of CVE-2026-1719 could allow an attacker to bypass authentication and directly query the WordPress database. This could result in the theft of sensitive information such as user credentials (usernames and passwords), customer data (names, addresses, payment information), booking details, and potentially even administrative configurations. The attacker could also modify or delete data within the database, leading to data integrity issues and service disruption. Given the widespread use of WordPress and Gravity Bookings, a successful attack could have a significant blast radius, impacting numerous websites and their users.
Contexte d'Exploitationtraduction en cours…
CVE-2026-1719 was published on May 5, 2026. Severity is currently assessed as HIGH (CVSS 7.5). Public proof-of-concept (POC) code is likely to emerge given the ease of SQL injection exploitation. While no active campaigns have been publicly reported as of this writing, the vulnerability's ease of exploitation makes it a potential target for automated scanning and exploitation tools. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
Renseignement sur les Menaces
Statut de l'Exploit
EPSS
0.08% (percentile 24%)
CISA SSVC
Vecteur CVSS
Que signifient ces métriques?
- Attack Vector
- Réseau — exploitable à distance via internet. Aucun accès physique ou local requis.
- Attack Complexity
- Faible — aucune condition spéciale requise. Exploitable de manière fiable.
- Privileges Required
- Aucun — sans authentification. Aucune identifiant requis pour exploiter.
- User Interaction
- Aucune — attaque automatique et silencieuse. La victime ne fait rien.
- Scope
- Inchangé — impact limité au composant vulnérable.
- Confidentiality
- Élevé — perte totale de confidentialité. L'attaquant peut lire toutes les données.
- Integrity
- Aucun — aucun impact sur l'intégrité.
- Availability
- Aucun — aucun impact sur la disponibilité.
Logiciel Affecté
Classification de Faiblesse (CWE)
Chronologie
- Réservé
- Publiée
- Modifiée
- EPSS mis à jour
Mitigation et Contournementstraduction en cours…
The primary mitigation for CVE-2026-1719 is to immediately upgrade Gravity Bookings Premium to version 2.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious SQL injection attempts targeting the vulnerable parameter. Specifically, look for unusual characters or SQL keywords in user input. Additionally, review and harden database user permissions to limit the potential damage from a successful injection. After upgrading, verify the fix by attempting a SQL injection attack on the vulnerable endpoint and confirming that the attack is blocked.
Comment corriger
Mettre à jour vers la version 2.6, ou une version corrigée plus récente
Questions fréquentestraduction en cours…
What is CVE-2026-1719 — SQL Injection in Gravity Bookings?
CVE-2026-1719 is a SQL Injection vulnerability affecting Gravity Bookings Premium for WordPress versions up to 2.5.9. It allows attackers to inject malicious SQL code to extract sensitive data from the database.
Am I affected by CVE-2026-1719 in Gravity Bookings?
You are affected if you are using Gravity Bookings Premium for WordPress version 2.5.9 or earlier. Check your plugin version using wp plugin list.
How do I fix CVE-2026-1719 in Gravity Bookings?
Upgrade Gravity Bookings Premium to version 2.6 or later. If immediate upgrade is not possible, implement WAF rules to filter SQL injection attempts.
Is CVE-2026-1719 being actively exploited?
While no active campaigns have been publicly reported, the vulnerability's ease of exploitation makes it a potential target. Monitor security advisories and threat intelligence feeds.
Where can I find the official Gravity Bookings advisory for CVE-2026-1719?
Refer to the official Gravity Bookings website and WordPress plugin repository for the latest security updates and advisories related to CVE-2026-1719.
Ton projet est-il affecté ?
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Détecte cette CVE dans ton projet
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Scannez votre projet WordPress maintenant — sans compte
scanZone.subtitle
Glissez-déposez votre fichier de dépendances
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...