CVE-2026-15289: WordPress Booking Calendar SQLi Vulnerability

CVE-2026-15289 Overview

CVE-2026-15289 is a time-based SQL injection vulnerability in the Booking Calendar, Appointment Booking System plugin for WordPress. The flaw affects all versions up to and including 3.2.17. The vulnerability exists in the wpdevart_id parameter due to insufficient escaping and missing query preparation in the plugin's SQL logic. Unauthenticated attackers can append additional SQL queries to extract sensitive database contents. Exploitation requires the Pro version of the plugin to be installed and activated with the Delete previous dates option enabled. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can exfiltrate sensitive information from the WordPress database via time-based blind SQL injection when the Pro plugin is configured with Delete previous dates enabled.

Affected Products

WordPress Booking Calendar, Appointment Booking System plugin (free)
WordPress Booking Calendar, Appointment Booking System Pro plugin
All versions up to and including 3.2.17

Discovery Timeline

2026-07-10 - CVE-2026-15289 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15289

Vulnerability Analysis

The vulnerability resides in the plugin's handling of the wpdevart_id HTTP parameter. The plugin passes user-controlled input into an SQL query without sufficient escaping and without using WordPress's prepared statement API $wpdb->prepare(). This allows an attacker to break out of the intended query structure and append arbitrary SQL clauses.

Because the injection point does not return query results directly to the response body, exploitation relies on time-based blind techniques. Attackers use SQL functions such as SLEEP() or conditional BENCHMARK() calls to infer data one bit at a time based on server response latency. Given enough requests, an unauthenticated attacker can enumerate database schemas, extract user credentials, session tokens, and WordPress secret keys stored in wp_users and wp_options.

Exploitation is gated by two conditions: the Pro version must be active, and the Delete previous dates option must be checked. This configuration causes the vulnerable code path in main_class.php to execute on incoming requests. The EPSS score for this CVE is 0.346% (percentile 26.942), indicating limited observed exploitation activity at publication.

Root Cause

The root cause is improper neutralization of user input passed into a raw SQL string. The plugin concatenates the wpdevart_id value directly into a query rather than binding it as a parameter with type-safe placeholders. Relevant code paths are located around lines 64, 90, and 91 of includes/main_class.php in the plugin's trunk repository.

Attack Vector

The attack is remote and unauthenticated. An attacker sends crafted HTTP requests to a WordPress site running the vulnerable plugin with the required Pro configuration. Payloads embed conditional time delays into the wpdevart_id parameter to perform boolean-based inference of database contents. High attack complexity reflects the configuration prerequisites and the multi-request nature of time-based extraction.

See the Wordfence Vulnerability Report and the WordPress Booking Calendar source reference for technical details on the vulnerable code paths.

Detection Methods for CVE-2026-15289

Indicators of Compromise

HTTP requests to WordPress endpoints containing the wpdevart_id parameter with SQL keywords such as SLEEP, BENCHMARK, IF(, SELECT, UNION, or comment sequences -- and /*.
Repeated requests from a single source with response times that vary in discrete intervals (5s, 10s), consistent with time-based blind extraction.
Abnormally high request volume to booking calendar endpoints from a single IP within a short timeframe.
Web server or PHP error log entries referencing SQL syntax errors originating from includes/main_class.php.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the wpdevart_id parameter for SQL metacharacters and time-delay function names.
Instrument the database layer to log queries exceeding a latency threshold and correlate slow queries with the requesting HTTP transaction.
Baseline normal response times for booking calendar endpoints and alert on statistical outliers.

Monitoring Recommendations

Aggregate WordPress access logs into a centralized log analytics platform and alert on parameter tampering patterns targeting wpdevart_id.
Monitor for successful reads of wp_users or wp_options outside of expected administrative workflows.
Track outbound requests from the web server that may indicate follow-on exploitation after credential extraction.

How to Mitigate CVE-2026-15289

Immediate Actions Required

Upgrade the Booking Calendar, Appointment Booking System plugin to a version later than 3.2.17 once the vendor publishes a fix.
Audit WordPress installations for the Pro plugin and identify sites where the Delete previous dates option is enabled.
Rotate WordPress secret keys in wp-config.php and reset administrator passwords if exploitation is suspected.
Review database access logs for the past 90 days for anomalous query patterns tied to booking calendar endpoints.

Patch Information

At the time of NVD publication on 2026-07-10, all versions up to and including 3.2.17 are affected. Administrators should consult the plugin listing on WordPress.org and the Wordfence advisory for the fixed release version.

Workarounds

Disable the Delete previous dates option in the Pro plugin configuration to remove the vulnerable code path from execution.
Deactivate the Booking Calendar Pro plugin until a patched version is available.
Deploy a WAF rule blocking requests where wpdevart_id contains non-numeric characters, since the parameter is expected to be an integer identifier.

bash

# Example ModSecurity rule blocking non-numeric wpdevart_id values
SecRule ARGS:wpdevart_id "!@rx ^[0-9]+$" \
    "id:1015289,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-15289: Non-numeric wpdevart_id parameter blocked',\
    tag:'attack-sqli',\
    tag:'CVE-2026-15289'"