CVE-2026-49073: WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability

Synopsis

A SQL injection vulnerability affects the wpWax Directorist Booking WordPress plugin at version 3.0.3 and earlier. The flaw is reachable over the network by any authenticated user with a low-privilege account (such as a subscriber or contributor), and no victim interaction is required to trigger it. Successful exploitation allows an attacker to extract sensitive data from the underlying database through blind SQL injection techniques, and may partially disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege WordPress account (such as a subscriber or contributor) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker can trigger the injection directly without any action from another user or administrator.

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or special environmental dependencies, though blind SQL injection requires iterative query techniques to extract data.

Blast Radius

• Reads stored database contents, including user records, session tokens, booking details, and any other data accessible to the database user, via blind SQL injection enumeration.
• Confidentiality impact is high with scope change, meaning data from database tables outside the plugin's immediate context may be accessible if the database user has broad permissions.
• Availability is partially affected; malformed or resource-intensive injected queries can slow or crash database-dependent functionality for the affected WordPress site.