Description

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-18T14:17:03.787Z",
  "pubdate": "2026-08-18T14:17:03.787Z",
  "executiveSummary": "An SQL injection vulnerability has been identified in the Gravity Forms Bookings premium plugin affecting versions 2.1 and prior. This security flaw allows authenticated users with subscriber-level privileges to execute arbitrary SQL queries against the underlying database. The vulnerability arises from improper sanitization and escaping of user-supplied input before it is incorporated into database queries within the vulnerable component.\nThe impact of this vulnerability is critical, potentially leading to unauthorized data access, data modification, data exfiltration, or complete database compromise depending on database user privileges. An attacker possessing low-privileged subscriber access can craft malicious database queries to extract sensitive information stored within the WordPress database, such as user credentials, plugin configurations, or booking details.\nExploitation of this flaw requires authenticated access at the subscriber privilege level, meaning an attacker must first obtain or establish a low-privileged user account on the target WordPress installation. The risk implication is significant for websites utilizing the affected plugin version, as it permits horizontal and vertical privilege escalation via data extraction. Remediation requires updating the plugin beyond version 2.1 once a vendor patch is made available or applying temporary hardening measures to restrict suspicious database interactions.",
  "technicalDetails": "The vulnerability exists within the input handling mechanisms of the Gravity Forms Bookings premium plugin in versions 2.1 and below. Specifically, the root cause lies in the failure of the application to adequately parameterize or sanitize input parameters before passing them to database query functions. This lack of robust input validation allows malicious SQL syntax to be injected directly into database queries executed by the plugin.\nThe attack vector requires network access and authentication. An attacker must authenticate as a user with subscriber-level privileges to interact with the vulnerable endpoints or parameters exposed by the plugin. Because the vulnerability is an SQL injection, the attacker crafts specialized HTTP requests containing malicious SQL payloads designed to manipulate the query logic executed by the underlying database management system.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker identifies an input parameter processed by the vulnerable component of Gravity Forms Bookings that lacks proper input sanitization. Second, the attacker formulates an SQL injection payload utilizing techniques such as UNION-based queries, boolean-based blind extraction, or time-based payloads. Third, the attacker submits the crafted request containing the payload to the server. Fourth, the vulnerable plugin incorporates the unsanitized input directly into an SQL statement executed against the database. Fifth, the database parses and executes the modified query, returning the results or inducing a state change. Finally, the attacker intercepts the response to extract sensitive data or infers database contents based on application behavior, achieving unauthorized access to database contents."
}