CVE-2026-111178 murgroland CVE debrief

Who should care

Administrators of WordPress installations with the WP Booking System – Booking Calendar plugin should assess exposure and verify that they are running a version with the fix applied.

Why it matters

CVE-2026-111178 is a SQL injection vulnerability in the WP Booking System – Booking Calendar plugin for WordPress. Administrators should verify that they are running a fixed version and assess exposure based on calendar booking counts.

• Verify plugin version and update if necessary
• Assess calendar booking counts to determine potential exposure
• Monitor for potential exploitation attempts

Technical summary

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and including, 2.1.0.1. Exploitation requires administrator-level access and above, and the targeted calendar must have more than 200 bookings. The vulnerability exists due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This could allow attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Defensive priority

Administrators of WordPress installations with the WP Booking System – Booking Calendar plugin should verify that they are running a version with the fix applied and assess exposure based on the number of bookings in their calendars.

Recommended defensive actions

• Verify that the WP Booking System – Booking Calendar plugin is updated to a version that addresses the SQL injection vulnerability
• Assess the number of bookings in WordPress calendars to determine potential exposure
• Monitor for potential exploitation attempts targeting the vulnerable plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in the WP Booking System – Booking Calendar plugin for WordPress. The vulnerability requires administrator-level access and above, and the targeted calendar must have more than 200 bookings.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.