CVE-2026-111178: WP Booking System SQL Injection Vulnerability

CVE-2026-111178 Overview

CVE-2026-111178 is a SQL Injection vulnerability in the WP Booking System – Booking Calendar plugin for WordPress. The flaw affects all versions up to and including 2.1.0.1. It allows authenticated attackers with administrator-level access to inject arbitrary SQL via the data[orderby] parameter. The vulnerability exists due to insufficient escaping of user-supplied input and lack of query preparation in the affected code paths. Successful exploitation enables extraction of sensitive database information. The weakness is classified under CWE-89.

Critical Impact
Authenticated administrators can append arbitrary SQL to existing queries and read sensitive data from the WordPress database, including user credentials and configuration secrets.

Affected Products

WP Booking System – Booking Calendar plugin for WordPress
All versions up to and including 2.1.0.1
Fixed in version 2.1.0.2

Discovery Timeline

2026-10-16 - CVE-2026-111178 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111178

Vulnerability Analysis

The vulnerability resides in the booking retrieval logic of the WP Booking System plugin. The data[orderby] parameter supplied through the AJAX handler is passed to the database layer without proper escaping or preparation. When the request routes through the use_ajax branch of the booking output handler, the attacker-controlled orderby value is concatenated directly into the SQL query assembled by the plugin's object-DB abstraction.

An attacker with administrator privileges can leverage this behavior to append additional SQL expressions, including UNION-based payloads, to the executing query. This enables extraction of arbitrary rows from any table accessible to the WordPress database user. The impact is limited to confidentiality; the vulnerability does not grant write or availability impact on its own.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The plugin assembles ORDER BY clauses by interpolating the orderby parameter without passing it through wpdb::prepare() or an allowlist of valid column names. Standard WordPress hardening practice requires validating ORDER BY values against a fixed set of acceptable columns, which the vulnerable code paths do not enforce. Review the vulnerable sinks in the Object DB abstract class and the Object DB Bookings class.

Attack Vector

Exploitation requires an authenticated session with administrator-level privileges or higher. The attacker sends an AJAX request to the booking endpoint with a crafted data[orderby] parameter. The vulnerable branch only executes when the targeted calendar contains more than 200 bookings. An administrator can satisfy this precondition by creating bookings directly before launching the injection. The attack path is documented in the Bookings Outputter and booking actions handler.

No verified proof-of-concept code is available in the referenced advisories. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-111178

Indicators of Compromise

Admin-ajax requests containing suspicious data[orderby] values with SQL keywords such as UNION, SELECT, SLEEP, or inline comments (--, /*)
Unusual spikes in booking creation activity preceding anomalous AJAX requests to the plugin's booking endpoint
Database query logs showing malformed ORDER BY clauses or references to tables unrelated to bookings such as wp_users or wp_usermeta

Detection Strategies

Enable WordPress query logging and inspect ORDER BY clauses originating from the WP Booking System plugin for non-column tokens
Deploy a web application firewall rule that inspects data[orderby] request parameters for SQL metacharacters
Review PHP error logs for syntax errors from $wpdb->get_results() calls associated with the plugin's booking functions

Monitoring Recommendations

Monitor authenticated admin sessions for abnormal AJAX traffic volume to admin-ajax.php with the plugin's booking actions
Alert on administrator accounts that create bulk bookings followed by booking retrieval requests with uncommon query strings
Track outbound responses from the booking endpoint for abnormally large payload sizes indicative of data exfiltration

How to Mitigate CVE-2026-111178

Immediate Actions Required

Upgrade the WP Booking System – Booking Calendar plugin to version 2.1.0.2 or later immediately
Audit WordPress administrator accounts and remove any unauthorized or dormant privileged users
Rotate database credentials and WordPress salts if administrator compromise is suspected
Review booking tables and wp_users records for signs of unauthorized access

Patch Information

The vendor released a fix in version 2.1.0.2. The patch introduces proper preparation and validation of the orderby parameter against an allowlist. Review the changeset comparison and the trunk changeset for exact code changes.

Workarounds

Temporarily deactivate the WP Booking System plugin until the patched version is deployed
Restrict administrator access to trusted personnel and enforce multi-factor authentication on all admin accounts
Deploy a WAF signature that blocks requests containing SQL metacharacters in the data[orderby] parameter
Limit the number of bookings per calendar below the 200-booking threshold where operationally feasible to avoid triggering the vulnerable code path

bash

# Update the plugin via WP-CLI
wp plugin update wp-booking-system --version=2.1.0.2

# Verify installed version
wp plugin get wp-booking-system --field=version