CVE-2026-91024: Booking Manager WordPress Plugin SQLi

CVE-2026-91024 Overview

CVE-2026-91024 is a SQL injection vulnerability [CWE-89] in the Booking Manager WordPress plugin before version 2.1.21. The plugin fails to sanitize and escape values retrieved from a fetched external iCalendar feed before using them in a SQL query. Authenticated users with Author-level access or higher can exploit this flaw by importing an attacker-controlled feed. Successful exploitation allows arbitrary SQL statements to execute against the WordPress database.

Critical Impact
Authenticated attackers with Author privileges can extract sensitive database contents, including user credentials and session data, by importing a malicious iCalendar feed.

Affected Products

Booking Manager WordPress plugin versions prior to 2.1.21
WordPress sites permitting Author-level or higher accounts to use the plugin's feed import functionality
Deployments that allow importing external iCalendar feeds from untrusted sources

Discovery Timeline

2026-09-23 - CVE-2026-91024 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91024

Vulnerability Analysis

The Booking Manager plugin supports importing bookings from external iCalendar (.ics) feeds. When the plugin fetches a remote feed, it parses fields such as event summaries, descriptions, and identifiers, then passes the extracted values directly into SQL statements. Because the plugin does not apply wpdb::prepare() or equivalent sanitization to those values, malicious iCalendar entries can break out of the intended query context.

An authenticated user with Author capability can host a crafted .ics file on an external server and instruct the plugin to import it. Fields in that feed become injection vectors executed against the WordPress database. The Author-level privilege requirement limits the pool of attackers to accounts that have some legitimate write access to the site.

Refer to the WPScan Vulnerability Report for the underlying technical analysis.

Root Cause

The root cause is missing input validation and parameterization on data returned from a remote iCalendar source. The plugin treats external feed data as trusted and concatenates it into SQL queries. This is a classic second-order SQL injection pattern where the malicious payload enters via one channel (feed import) and executes in another (database query).

Attack Vector

Exploitation requires an authenticated account with Author-level access or higher and network reachability to a feed URL the attacker controls. The attacker publishes a crafted iCalendar feed containing SQL syntax within standard fields such as SUMMARY, DESCRIPTION, or UID. The attacker then triggers a feed import in the WordPress admin interface, causing the injected SQL to execute in the database context of the plugin.

No verified public exploit code is available. The vulnerability mechanics are described in prose based on the vendor advisory rather than reproduced here.

Detection Methods for CVE-2026-91024

Indicators of Compromise

Booking Manager plugin feed import logs referencing external URLs on untrusted domains
Unexpected iCalendar imports initiated by Author-level accounts
WordPress database queries originating from the plugin containing SQL metacharacters such as UNION, SELECT, or -- inside event fields
Unusual outbound HTTP requests from the WordPress host to attacker-controlled .ics endpoints

Detection Strategies

Inventory WordPress installations to identify Booking Manager versions below 2.1.21
Monitor WordPress audit logs for feed import actions and cross-reference source URLs against allowlists
Enable database query logging on wp_posts, wp_postmeta, and plugin-specific tables to surface anomalous SQL patterns
Deploy a web application firewall rule set that inspects payloads passed to the plugin's feed import endpoints

Monitoring Recommendations

Alert on any new or modified Author-level accounts, particularly those created shortly before a feed import event
Correlate outbound network requests from PHP workers with WordPress admin actions to detect malicious feed retrievals
Track query error rates from the WordPress database; SQL injection attempts often generate syntax errors before succeeding

How to Mitigate CVE-2026-91024

Immediate Actions Required

Upgrade the Booking Manager plugin to version 2.1.21 or later on all WordPress sites
Audit Author-level and higher accounts and revoke access for users who do not require it
Review recent iCalendar feed import history for imports from unrecognized external hosts
Rotate WordPress database credentials and administrator passwords if compromise is suspected

Patch Information

The vendor addressed the SQL injection in Booking Manager version 2.1.21 by sanitizing and escaping values obtained from external iCalendar feeds before use in SQL queries. Update through the WordPress plugin management interface or by deploying the fixed release from the official repository. Confirm the version reported in wp-admin after upgrade.

Workarounds

Restrict feed import capabilities to Administrator accounts only until the patch is applied
Block outbound HTTP requests from the WordPress host to unapproved domains to prevent fetching attacker-controlled feeds
Temporarily disable the Booking Manager plugin if patching cannot be completed promptly

bash

# Verify installed plugin version and update via WP-CLI
wp plugin get booking-manager --field=version
wp plugin update booking-manager --version=2.1.21