A vulnerability, which was classified as critical, was found in masaakitanaka Booking Package Plugin up to 1.7.20 on WordPress. The impacted element is an unknown function of the file /wp-json/booking-package/v1/request of the component REST API Endpoint. The manipulation of the argument email results in sql injection.
This vulnerability is identified as CVE-2026-15335. The attack can be executed remotely. There is not any exploit available.
Intelligence View
⚡ tsecurity.de Intelligence
CVE-2026-15335 | masaakitanaka Booking Package Plugin up to 1.7.20 on WordPress REST API Endpoint request email sql injection (EUVD-2026-43143)
A vulnerability, which was classified as critical, was found in masaakitanaka Booking Package Plugin up to 1.7.20 on WordPress. The impacted element is an unknown function of the file /wp-json/booking-package/v1/request of the component…
Reagiere als Erste:r — dein Feedback zählt!
SOCIAL SHARE CARD GENERATOR