External risk intelligence

WP BASE Booking SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-124970

The vulnerability affects a WordPress plugin designed for booking appointments, services, and events. Such plugins are typically deployed on public-facing websites to allow user interaction, making the web interface and associated endpoints commonly accessible via the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a SQL injection vulnerability in the WP BASE Booking plugin, a common tool for managing appointments and services. This type of flaw could potentially allow unauthorized access to sensitive data or manipulation of the application's database if exploited, impacting services that rely on the plugin. The primary concern is to confirm if this specific plugin is in use and, if so, understand its exposure.

Code allows attackers to inject commands.
Affects customer booking and service management.
Confirm usage and exposure; assess impact.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this SQL injection vulnerability by sending specially crafted input to the affected WordPress plugin. Since the vulnerability is present in a booking plugin likely exposed to the internet, an unauthenticated attacker could potentially trigger it. Successful exploitation could lead to unauthorized access to sensitive data or manipulation of application data.

No authentication required.
Malicious input in booking feature.
Blind SQL injection, data exposure risk.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the WP BASE Booking plugin could allow an unauthenticated attacker to perform a blind SQL injection when the plugin is used. This could potentially lead to the disclosure of sensitive information from the application's database.

Database information could be exposed.
Via specially crafted requests to the plugin.
Leading to data leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the WP BASE Booking plugin requires immediate attention from the application owner and potentially the platform or infrastructure teams. The first step is to identify all instances of this plugin across your web properties, confirm its exposure to the internet, and assess its business criticality to prioritize remediation efforts. Coordination with the vendor for a patched version or alternative mitigation strategies should also be a priority.

Application owners must triage exposure.
Verify external accessibility and business impact.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP BASE Booking plugin used for?

WP BASE Booking is a WordPress plugin designed to help website owners manage appointments, services, and event scheduling. It provides the interface customers use to view availability and book slots directly on a site. Because it handles interactive scheduling, it typically requires a web-facing presence to function.

What does SQL injection mean for CVE-2026-124970?

This vulnerability, classified as CWE-89, occurs when a program fails to properly sanitize input before using it in database queries. In the context of CVE-2026-124970, it allows an attacker to inject their own malicious SQL commands. This specific type is known as 'Blind' SQL injection, meaning the attacker cannot see the direct output of their query but can infer information from the application's responses.

How can an attacker trigger this vulnerability?

An attacker can trigger this flaw by sending specifically formatted requests to the plugin's booking features. No user account or authentication is required to initiate these requests. It is important to note that simply visiting the website or viewing a booking page does not trigger the bug; the attacker must deliberately submit malicious data intended to manipulate the underlying database.

Is my website at risk from this CVE?

Halo Surface Signal indicates that since this is a booking plugin, it is often deployed on public-facing websites to facilitate user interaction. If your site uses this plugin and is accessible via the internet, it is considered externally exposed. Internal sites that are not reachable from the public internet have a reduced risk profile regarding this specific network-based entry point.

What are the first steps to address this issue?

Start by identifying every WordPress instance in your environment that has the WP BASE Booking plugin installed. Once identified, evaluate whether the site is accessible to the public and determine the sensitivity of the data managed by the plugin. Finally, monitor for official updates from the plugin vendor to apply a patch as soon as one becomes available.

References

patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointm…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.