CVE-2026-32358: 
WordPress vulnerability analysis and mitigation

CVE-2026-32358 is a Blind SQL Injection vulnerability in the wpdevelop Booking Calendar WordPress plugin, affecting all versions up to and including 10.14.15. The flaw was reported on January 15, 2026, by researcher mcdruid and publicly disclosed by Patchstack on February 14, 2026. It carries a CVSS v3.1 base score of 7.6 (High), requiring high privileges (Editor-level) and no user interaction (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and enables Blind SQL Injection. An authenticated attacker with Editor-level privileges can craft malicious input that is passed unsanitized into SQL queries, allowing inference-based extraction of database contents without direct query output. The attack is network-based, requires no user interaction, and has a changed scope, meaning the impact extends beyond the vulnerable component itself (Patchstack).

Successful exploitation primarily impacts confidentiality, allowing an attacker to extract sensitive data from the WordPress database — including user credentials, booking records, and other stored information — without direct query output visibility. Availability is also marginally affected (Low impact per CVSS). Integrity is not directly impacted, though database read access could facilitate further attacks such as credential theft and account takeover (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. Exploitation requires Editor-level authentication, which significantly limits the attacker pool. Patchstack classifies this as low priority with unlikely exploitation, and it does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Booking Calendar plugin (wpdevelop) at version 10.14.15 or earlier using tools like WPScan or Shodan.
2. Authentication: Obtain or compromise an Editor-level (or higher) WordPress account on the target site.
3. Identify vulnerable parameter: Navigate to the Booking Calendar plugin's administrative interface and identify input fields or parameters that interact with the database without proper sanitization.
4. Craft blind SQL injection payload: Inject time-based or boolean-based blind SQL payloads (e.g., using SLEEP() or conditional AND 1=1/1=2 logic) into the vulnerable parameter to infer database structure and content.
5. Extract data: Use automated tools such as sqlmap with session cookies to systematically enumerate database tables, columns, and extract sensitive data (e.g., WordPress user hashes, booking records). (Patchstack)

• Logs: WordPress or web server access logs showing repeated requests to Booking Calendar plugin endpoints with unusual SQL syntax fragments (e.g., SLEEP, AND 1=, OR 1=1, BENCHMARK) in parameter values.
• Logs: Database slow query logs showing repeated time-delayed queries originating from the WordPress application user.
• Network: Unusual volume of authenticated POST/GET requests to Booking Calendar admin pages from a single IP address, potentially indicating automated blind SQL injection enumeration.
• Process: Elevated database query times or spikes in database CPU usage without corresponding legitimate traffic increases.

The vendor (wpdevelop) has released version 10.14.16 of the Booking Calendar plugin, which patches this vulnerability. Site administrators should update to version 10.14.16 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, restricting Editor-level access to trusted users only can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).