CVE-2026-3496

The JetBooking plugin for WordPress, versions 4.0.3 and earlier, contains a SQL injection vulnerability in the check_in_date parameter. The root cause is insufficient escaping of user-supplied input and lack of prepared statements in the SQL query construction [1].

An unauthenticated attacker can exploit this by sending a crafted HTTP request containing malicious SQL code in the check_in_date parameter. Because the parameter is not properly sanitized, the injected SQL becomes part of the existing query, allowing the attacker to modify the query's logic [1].

The primary impact is data confidentiality. A successful attack can enable the attacker to extract sensitive information from the WordPress database, such as user credentials, session tokens, or plugin configuration data. The vulnerability does not require authentication, increasing its severity [1].

The vendor, Crocoblock, has released a patched version of the JetBooking plugin to address this issue. Users are advised to update to the latest version as soon as possible [1].