CVE-2026-15335: Booking Package WordPress SQL Injection

CVE-2026-15335 Overview

The Booking Package plugin for WordPress contains an unauthenticated SQL injection vulnerability [CWE-89] in the email form parameter. All versions up to and including 1.7.20 are affected. The flaw resides in the REST API endpoint /wp-json/booking-package/v1/request, which is registered with permission_callback: __return_true. This configuration permits unauthenticated access. User-supplied input flows into an SQL query without adequate escaping or preparation. Attackers can append additional SQL statements to extract sensitive data from the database. Exploitation is limited because the vulnerable parameter passes through is_email validation, constraining the payload structure.

Critical Impact

Unauthenticated attackers can extract sensitive information from the WordPress database by injecting SQL fragments through the email form parameter, subject to is_email format constraints.

Affected Products

• Booking Package plugin for WordPress, versions up to and including 1.7.20
• WordPress sites exposing the /wp-json/booking-package/v1/request REST endpoint
• Any deployment relying on the plugin's form<N> submission handlers

Discovery Timeline

• 2026-07-11 - CVE-2026-15335 published to NVD
• 2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15335

Vulnerability Analysis

The Booking Package plugin exposes a REST route at /wp-json/booking-package/v1/request that accepts form submissions from unauthenticated clients. The route handler processes an email parameter tied to dynamic form fields named form<N>. That value reaches an SQL query without prepared statements or proper escaping. Attackers can therefore append SQL fragments that alter query semantics and read arbitrary data from the WordPress database.

WordPress normally applies wp_magic_quotes to $_POST data, which would escape single quotes. However, REST API requests bypass this normalization. Values submitted through the REST endpoint reach the SQL sink with quote characters intact, enabling injection.

Root Cause

The root cause is twofold: the plugin fails to use $wpdb->prepare() or equivalent parameterization for the email field, and the REST route uses permission_callback: __return_true, granting unauthenticated access. Combined with the absence of magic-quote escaping on REST-sourced POST data, single quotes and SQL metacharacters reach the query builder untouched.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP POST request to /wp-json/booking-package/v1/request containing a malicious email field within a form<N> payload. Because the parameter passes through is_email, the injection string must remain syntactically valid as an email address. This constraint limits the payload shape but does not prevent exfiltration through boolean-based or comment-terminated injection patterns. The affected code paths are documented in the WordPress Plugin Code Reference for Schedule.php and additional lines in index.php and Schedule.php of tag 1.7.20.

Detailed technical analysis is available in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-15335

Indicators of Compromise

• POST requests to /wp-json/booking-package/v1/request containing SQL keywords such as UNION, SELECT, SLEEP, or -- inside the email parameter.
• Unusual database query latency correlated with requests to the booking-package REST endpoint.
• Web server access logs showing repeated REST calls from a single IP with varying email payloads consistent with automated SQLi tooling.

Detection Strategies

• Enable WordPress query logging and inspect queries originating from the Booking Package plugin for concatenated user input.
• Deploy a Web Application Firewall rule that inspects the email parameter on the affected REST route for SQL metacharacters and boolean patterns.
• Correlate application-layer telemetry with database error logs to identify malformed queries caused by injection attempts.

Monitoring Recommendations

• Alert on any HTTP 500 responses from /wp-json/booking-package/v1/request that follow requests with atypical email values.
• Monitor outbound data volume from the WordPress database host for signs of bulk extraction.
• Track REST API request rates per source IP against booking endpoints to identify automated probing.

How to Mitigate CVE-2026-15335

Immediate Actions Required

• Update the Booking Package plugin to a version above 1.7.20 that includes the fix from the WordPress Plugin Changeset 3602166.
• If an update is not immediately possible, disable the plugin until a patched release is deployed.
• Review WordPress database access logs for evidence of prior exploitation attempts.

Patch Information

The vendor addressed the vulnerability in a subsequent release tracked by changeset 3602166. Administrators should upgrade to the latest available version and verify that the fix applies proper preparation to the email parameter in both index.php and lib/Schedule.php. Confirm the plugin version through the WordPress admin dashboard after upgrade.

Workarounds

• Restrict access to the /wp-json/booking-package/v1/request endpoint through WAF rules or .htaccess allowlisting until the patch is applied.
• Deploy a virtual patch that rejects any email parameter containing SQL metacharacters or exceeding standard email length limits.
• Temporarily disable the plugin on production sites that do not require booking functionality.

# Configuration example: block SQLi patterns in the email parameter via Nginx
location /wp-json/booking-package/v1/request {
    if ($request_method = POST) {
        if ($request_body ~* "(union|select|sleep|benchmark|--|/\*)") {
            return 403;
        }
    }
}