CVE Intelligence
Analysis AI-assisted

CVE-2026-54820: JetBooking: Unauthenticated SQL Injection

CVE-2026-54820 is an unauthenticated SQL Injection (CWE-89) in JetBooking versions up to and including 4.0.4.1, as described by the CNA Patchstack. The CNA assigned a CVSS 3.1 base score of 9.3 (critical). The record lists no affected or fixed version data, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CNA Patchstack reports an unauthenticated SQL Injection vulnerability (CWE-89) in JetBooking versions up to and including 4.0.4.1. The cited Patchstack reference is a vulnerability database entry under a WordPress plugin path, which suggests the product is a WordPress plugin.

Impact

  • The CVSS 3.1 base score assigned by the CNA is 9.3 (critical). The vector describes a network attack, low complexity, no privileges and no user interaction required.
  • The vector lists high confidentiality impact, no integrity impact and low availability impact. This suggests unauthorized reading of database content is the main concern, which is an inference from the vector.

Affected products and versions

  • Product: JetBooking, versions up to and including 4.0.4.1, according to the description.
  • The record contains no structured list of affected or fixed versions.

Exploitation status

  • The record does not list this CVE in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.004 with a percentile of 0.32423, dated 2026-10-13.

Remediation and mitigation

  • No fixed version is listed in the record. This does not mean no fix exists. Check the vendor and the Patchstack advisory for updates.
  • Until a fix is confirmed, consider reducing exposure of the affected component and reviewing the vendor guidance.
  • Keep verified backups of the database and the site before applying any change.

Detection guidance

  • Review web server and application logs for unusual parameter values or database error messages on booking-related requests.
  • Monitor for unexpected database queries, data changes or data exports.

Limitations of the available information

  • The record does not provide structured affected version ranges, fixed versions or vendor advisory text.
  • The exact vulnerable endpoints and parameters are not described in the record.
  • Exploitation status beyond the absence of KEV listing is unknown.

Frequently asked questions

What is CVE-2026-54820?

It is an unauthenticated SQL Injection (CWE-89) in JetBooking versions up to and including 4.0.4.1, as described by the CNA Patchstack.

How severe is it according to the record?

The CNA assigned a CVSS 3.1 base score of 9.3, rated critical. The vector indicates network attack with no privileges or user interaction needed.

Is this CVE known to be exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version?

The record lists no fixed version. This does not mean no fix exists, so check the vendor and the Patchstack advisory.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.