CVE-2026-1719: Gravity Bookings Premium SQLi Vulnerability

CVE-2026-1719 Overview

CVE-2026-1719 is a SQL Injection vulnerability affecting the Gravity Bookings Premium plugin for WordPress in all versions up to and including 2.5.9. The flaw stems from insufficient escaping on a user-supplied parameter combined with a lack of proper preparation on an existing SQL query. Unauthenticated attackers can append additional SQL queries to the existing query and extract sensitive information from the WordPress database. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). It is exploitable remotely over the network without authentication or user interaction.

Critical Impact

Unauthenticated remote attackers can extract sensitive data such as user credentials, session tokens, and personally identifiable information from WordPress databases hosting the affected plugin.

Affected Products

• Gravity Bookings Premium plugin for WordPress, versions through 2.5.9
• WordPress installations running the Gravity Bookings Premium plugin
• Any site exposing booking functionality provided by the affected plugin versions

Discovery Timeline

• 2026-05-06 - CVE-2026-1719 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-1719

Vulnerability Analysis

The Gravity Bookings Premium plugin builds a SQL query using a user-supplied parameter without applying proper escaping or query preparation. WordPress provides the $wpdb->prepare() method specifically to safely parameterize SQL statements, but the affected code path concatenates untrusted input directly into the query string. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses such as UNION SELECT statements. The result is unauthenticated read access to any data the plugin's database user can reach, which on a typical WordPress installation includes the entire wp_users and wp_usermeta tables.

Root Cause

The root cause is twofold: the parameter is not escaped using esc_sql() or sanitized through type coercion, and the resulting query is executed without $wpdb->prepare() placeholders. Either control alone could have prevented exploitation. Their absence allows the input to be parsed as SQL syntax rather than as a literal value.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the plugin. The malicious payload is placed in the affected parameter and embeds SQL syntax such as boolean operators, UNION clauses, or time-based blind injection primitives. The server executes the concatenated query and returns data through the response body, error messages, or measurable timing differences. No user interaction or privileges are required.

No verified public exploit code is available at the time of publication. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-1719

Indicators of Compromise

• HTTP requests to Gravity Bookings plugin endpoints containing SQL meta-characters such as ', ", --, UNION, SELECT, or SLEEP(
• Anomalous spikes in WordPress database query duration or rows returned to plugin endpoints
• Web server access logs showing repeated requests to the same plugin endpoint with varying parameter values consistent with automated SQLi tooling
• Outbound queries against wp_users or wp_options originating from the plugin's request handlers

Detection Strategies

• Deploy a WordPress-aware web application firewall (WAF) ruleset that flags SQL injection patterns targeting /wp-admin/admin-ajax.php and Gravity Bookings REST routes
• Enable WordPress database query logging and alert on queries containing operator patterns like UNION SELECT, OR 1=1, or stacked statements originating from the plugin
• Correlate web access logs with database slow-query logs to surface time-based blind injection attempts

Monitoring Recommendations

• Continuously monitor plugin inventory and version data across WordPress fleets to identify hosts running Gravity Bookings Premium 2.5.9 or earlier
• Track failed authentication events following suspicious database queries, which may indicate credential extraction and reuse
• Review CDN and reverse proxy logs for high-volume parameter fuzzing against booking-related endpoints

How to Mitigate CVE-2026-1719

Immediate Actions Required

• Identify all WordPress instances running Gravity Bookings Premium and inventory their installed versions
• Update the plugin to a version newer than 2.5.9 once the vendor releases a patched build, as referenced in the Wordfence advisory
• Rotate WordPress administrator passwords, API keys, and secret salts in wp-config.php if exploitation is suspected
• Restrict database user privileges so the WordPress account cannot read tables outside its required scope

Patch Information

Refer to the vendor's site at Gravity Booking Homepage and the Wordfence Vulnerability Report for the fixed release. Apply the upgrade through the WordPress plugin management console or via WP-CLI as soon as the patched version is available.

Workarounds

• Temporarily deactivate the Gravity Bookings Premium plugin until a patched version is installed
• Place a WAF in front of the WordPress site with a virtual patch rule blocking SQL meta-characters in plugin parameters
• Restrict access to booking endpoints via IP allow-listing or HTTP authentication where business requirements permit

# Configuration example: WP-CLI inventory and update workflow
wp plugin list --field=name,version | grep -i gravity-bookings
wp plugin deactivate gravity-bookings-premium
wp plugin update gravity-bookings-premium
wp plugin activate gravity-bookings-premium