Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.
Published: 2026-10-09
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability stems from improper neutralization of special elements in SQL commands within the EduAdmin Booking plugin, which allows a blind SQL injection. An attacker could remotely send crafted requests to the plugin’s endpoints to extract sensitive information, modify database contents, or potentially gain elevated privileges on the WordPress site.

Affected Systems

Any installation of the MultiNet Interactive AB EduAdmin Booking WordPress plugin running a version earlier than 6.0.0 is affected. The fix is available in version 6.0.0 and later.

Risk and Exploitability

The CVSS score of 9.3 indicates a severe risk; the EPSS score is not reported, and the vulnerability is not in the CISA KEV catalog. Attackers can trigger the vulnerability from the public web interface, typically without authentication, implying a remote attack vector. The high severity suggests that exploitation could lead to data exposure or further compromise of the site.

Generated by OpenCVE AI on October 9, 2026 at 11:59 UTC.

Remediation

Vendor Solution

Update the WordPress EduAdmin Booking plugin to the latest available version (at least 6.0.0).

OpenCVE Recommended Actions

  • Update the EduAdmin Booking plugin to version 6.0.0 or later.
  • Apply a web application firewall rule or filter to block suspicious SQL patterns or restrict access to the plugin’s admin and API URLs if an immediate update is not possible.
  • Review and strengthen the database credentials used by the WordPress installation, ensuring that the plugin operates with the minimum necessary privileges.

Generated by OpenCVE AI on October 9, 2026 at 11:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.
Title WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T12:03:20.949Z

Reserved: 2026-09-23T17:00:14.455Z

Link: CVE-2026-96809

cve-icon Vulnrichment

Updated: 2026-10-11T11:53:50.048Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T10:16:45.980

Modified: 2026-10-11T12:17:30.817

Link: CVE-2026-96809

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T12:00:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')