CVE-2026-48882: WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the WP Time Slots Booking Form WordPress plugin (versions 1.2.50 and earlier) allows a network-based attacker with a low-privilege subscriber account to inject malicious SQL into database queries. No authentication beyond a basic subscriber role is needed, and the scope extends beyond the vulnerable component itself. Successful exploitation gives the attacker read access to sensitive database contents and can degrade service availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege subscriber account is sufficient; no administrator or elevated role is needed to trigger the injection.

• Victim interactionNot required

  The attack is fully server-side and does not require any action from another user or administrator.

• Attack complexityDetail

  Exploit reliability is high: no race conditions, special memory layout, or environmental preconditions are required beyond network access and valid credentials.

Blast Radius

• Reads arbitrary database rows, including stored user credentials, session tokens, booking records, and any personal data held in the WordPress database.
• The changed scope (S:C) means impact can extend beyond the WordPress database itself to other data accessible by the database user account.
• Causes partial availability degradation of the affected service, consistent with the A:L CVSS token, meaning the booking form or broader WordPress site may become slow or intermittently unresponsive.