CVE-2026-1719: SQL Injection in Gravity Bookings
プラットフォーム
wordpress
コンポーネント
gf-bookings-premium
修正版
2.6
CVE-2026-1719 describes a SQL Injection vulnerability discovered in Gravity Bookings Premium, a plugin for WordPress. This flaw allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized data extraction. The vulnerability affects versions of Gravity Bookings Premium up to and including 2.5.9. A fix is available in version 2.6.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
Successful exploitation of CVE-2026-1719 could allow an attacker to bypass authentication and directly query the WordPress database. This could result in the theft of sensitive information such as user credentials (usernames and passwords), customer data (names, addresses, payment information), booking details, and potentially even administrative configurations. The attacker could also modify or delete data within the database, leading to data integrity issues and service disruption. Given the widespread use of WordPress and Gravity Bookings, a successful attack could have a significant blast radius, impacting numerous websites and their users.
悪用の状況翻訳中…
CVE-2026-1719 was published on May 5, 2026. Severity is currently assessed as HIGH (CVSS 7.5). Public proof-of-concept (POC) code is likely to emerge given the ease of SQL injection exploitation. While no active campaigns have been publicly reported as of this writing, the vulnerability's ease of exploitation makes it a potential target for automated scanning and exploitation tools. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
脅威インテリジェンス
エクスプロイト状況
EPSS
0.08% (24% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- なし — 認証不要。資格情報なしで悪用可能。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- 高 — 機密性の完全喪失。全データが読み取り可能。
- Integrity
- なし — 完全性への影響なし。
- Availability
- なし — 可用性への影響なし。
影響を受けるソフトウェア
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2026-1719 is to immediately upgrade Gravity Bookings Premium to version 2.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious SQL injection attempts targeting the vulnerable parameter. Specifically, look for unusual characters or SQL keywords in user input. Additionally, review and harden database user permissions to limit the potential damage from a successful injection. After upgrading, verify the fix by attempting a SQL injection attack on the vulnerable endpoint and confirming that the attack is blocked.
修正方法
バージョン 2.6、またはそれ以降の修正されたバージョンにアップデートしてください
よくある質問翻訳中…
What is CVE-2026-1719 — SQL Injection in Gravity Bookings?
CVE-2026-1719 is a SQL Injection vulnerability affecting Gravity Bookings Premium for WordPress versions up to 2.5.9. It allows attackers to inject malicious SQL code to extract sensitive data from the database.
Am I affected by CVE-2026-1719 in Gravity Bookings?
You are affected if you are using Gravity Bookings Premium for WordPress version 2.5.9 or earlier. Check your plugin version using wp plugin list.
How do I fix CVE-2026-1719 in Gravity Bookings?
Upgrade Gravity Bookings Premium to version 2.6 or later. If immediate upgrade is not possible, implement WAF rules to filter SQL injection attempts.
Is CVE-2026-1719 being actively exploited?
While no active campaigns have been publicly reported, the vulnerability's ease of exploitation makes it a potential target. Monitor security advisories and threat intelligence feeds.
Where can I find the official Gravity Bookings advisory for CVE-2026-1719?
Refer to the official Gravity Bookings website and WordPress plugin repository for the latest security updates and advisories related to CVE-2026-1719.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
WordPressプロジェクトを今すぐスキャン — アカウント不要
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...