Description

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-23T06:17:05.417Z",
  "pubdate": "2026-09-23T06:17:05.417Z",
  "executiveSummary": "The Booking Manager WordPress plugin, in versions prior to 2.1.21, contains a critical SQL injection vulnerability originating from improper handling of external iCalendar feed data.\nThe vulnerability allows authenticated users with Author-level privileges or higher to manipulate database queries by supplying malicious data within an iCalendar feed controlled by the attacker.\nThe root cause is the lack of input sanitization and output escaping when processing externally fetched feed content before incorporating that data into SQL statements.\nSuccessful exploitation permits unauthorized access to the database, potentially leading to sensitive data exposure, unauthorized modification of records, or administrative privilege escalation.\nThis vulnerability poses a significant risk to site integrity and confidentiality, as it enables authenticated attackers to execute arbitrary SQL commands against the WordPress backend database.\nExploitation requires the attacker to have at least Author-level access and the ability to define the URL of the iCalendar feed processed by the plugin.",
  "technicalDetails": "The Booking Manager plugin includes functionality to import event data from external sources via iCalendar (iCal) feeds. The vulnerability exists because the plugin fails to perform adequate sanitization or parameterization on the data extracted from these feeds before using it in database operations.\nSpecifically, when the plugin fetches data from a user-provided iCalendar URL, it parses the content and directly incorporates these values into SQL queries. Because this input is attacker-controlled, an attacker can craft a malicious iCal file hosted at a remote URL that contains SQL injection payloads within specific fields (e.g., event descriptions, summaries, or location fields).\nWhen the plugin processes this feed, these malicious payloads are interpreted as part of the SQL command rather than as literal string data. This breaks the intended structure of the query and allows for the injection of arbitrary SQL syntax.\nThe attack flow proceeds as follows: 1) An authenticated user with Author-level access (or higher) navigates to the plugin's import functionality. 2) The attacker supplies a URL pointing to a malicious iCalendar file they control. 3) The plugin fetches the file and parses the contents. 4) The plugin executes a SQL query that concatenates the unsanitized feed data. 5) The database engine executes the attacker's injected SQL commands.\nThis SQL injection is not limited to simple SELECT statements; it can be used for UNION-based attacks to retrieve sensitive information from other tables, blind SQL injection to infer data, or even modification/deletion of records if the database user permissions allow. The lack of parameterized queries or proper escaping functions, such as $wpdb->prepare(), constitutes the primary failure in secure coding practices.\nThe vulnerability is present in versions of the Booking Manager plugin before 2.1.21. Given that the plugin processes external data, any authenticated user capable of triggering the import process effectively has the ability to execute database queries with the permissions level of the WordPress database user, significantly undermining the security posture of the application."
}