CVE Intelligence
Analysis AI-assisted

CVE-2026-22336: Directorist Booking WordPress Plugin before 3.0.2 SQL Injection

CVE-2026-22336 is an SQL injection weakness (CWE-89) in the Directorist Booking plugin for WordPress, which the record places in versions before 3.0.2. The CNA, Patchstack, assigns a CVSS 3.1 base score of 9.3 (critical). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-22336 describes an SQL injection weakness classified as CWE-89 in the Directorist Booking plugin for WordPress. According to the record, the affected range is versions before 3.0.2. The entry was published by Patchstack as CNA and is tracked in the Patchstack vulnerability database.

Impact

  • SQL injection can allow input to alter database queries, which may expose or modify data stored by the site.
  • The CVSS 3.1 vector in the record (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes a network-reachable flaw with low complexity, no privileges and no user interaction required, with a changed scope, high confidentiality impact, no integrity impact and low availability impact.
  • The record also rates technical impact as partial and marks the issue as automatable under SSVC.

Affected products and versions

  • Product listed in the record: Directorist Booking (Directorist Booking).
  • Affected range in the record: versions before 3.0.2.
  • The record contains no fixed-version field, so the fix boundary should be confirmed with the vendor or the Patchstack entry.

Exploitation status

  • The record shows kev.listed as false, so this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the data assembled.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC exploitation is recorded as none. The FIRST EPSS probability is 0.00283 with a percentile of 0.19273, as recorded.

Remediation and mitigation

  • Update the Directorist Booking plugin to version 3.0.2 or later, which is the boundary given by the affected range.
  • If an immediate update is not possible, deactivate the plugin where it is not essential and limit access to administrative and booking functions.
  • Apply the principle of least privilege to the database account used by WordPress, and keep WordPress core and other plugins current.
  • Consider web application firewall rules from your provider as a temporary compensating control, while recognizing they do not replace patching.

Detection guidance

  • Review web server and application logs for unusual parameters or repeated errors on booking-related pages.
  • Watch for unexpected database errors, unexplained changes to booking or user records, and new administrative accounts.
  • Compare installed plugin versions across the estate against the 3.0.2 boundary to find assets that still need updating.

Limitations of the available information

  • The record does not identify the vulnerable parameter, endpoint or exploitation prerequisites beyond the CVSS vector.
  • No fixed version is listed in the fixes field; 3.0.2 is inferred from the affected range.
  • Two CVSS entries with the same score are attributed to different provider labels; they do not change the score.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-04-27), so the date should be verified against the source feed.

Frequently asked questions

Is CVE-2026-22336 listed in CISA KEV?

No. The record shows kev.listed as false, so it is not listed in the CISA Known Exploited Vulnerabilities catalog in the data assembled.

Which version should I update to?

The affected range in the record is versions before 3.0.2, so 3.0.2 is the boundary. The record has no separate fixed-version field, so confirm the details with the vendor or the Patchstack entry.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.