CVE-2026-96809: WordPress EduAdmin Booking plugin - SQL Injection

Overview

CVE-2026-96809 describes a blind SQL Injection (CWE-89) in the EduAdmin Booking plugin (eduadmin-booking) for WordPress, developed by MultiNet Interactive AB. The CVE record was published by Patchstack as CNA and lists versions before 6.0.0 as affected. See the CVE record and the NVD entry.

Impact

• The CVSS 3.1 score is 9.3 (critical), reported by Patchstack and repeated in the record's score list.
• The vector indicates network reachability, no privileges and no user interaction required, scope change, high confidentiality impact, low availability impact and no integrity impact.
• Blind SQL Injection means an attacker could potentially read or infer database content without direct query output. The exact data exposure depends on the plugin's database context, which the record does not describe.

Affected products and versions

• Product: MultiNet Interactive AB EduAdmin Booking (WordPress plugin eduadmin-booking).
• Affected range in the record: versions before 6.0.0 (the record reads 'from n/a before 6.0.0').
• The record's fixes list is empty. The affected range suggests that 6.0.0 or later is outside the range, but this is an inference that should be confirmed with the vendor or the Patchstack entry.

Exploitation status

• CISA KEV: not listed in the record.
• No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
• The record shows an EPSS probability of 0.00243 (percentile 0.14315) and an SSVC exploitation value of 'none'. These are indicators of current signals, not proof of attacks.

Remediation and mitigation

• Identify all WordPress sites running the EduAdmin Booking plugin and record installed versions.
• Update the plugin to version 6.0.0 or later, or to the newest vendor release, as soon as it is verified.
• Until the update is applied, consider restricting access to the plugin's public endpoints, placing a web application firewall in front of the site, and reviewing database account privileges so the plugin account has only the access it needs.
• Keep WordPress core and other plugins updated and remove unused plugins.

Detection guidance

• Review web server and application logs for unusual or malformed parameter values sent to booking-related pages.
• Monitor database logs for errors, unexpected query patterns or slow queries originating from the web application.
• Track changes to plugin files and unexpected administrative accounts on affected WordPress installations.

Limitations of the available information

• The record's source_status is 'Deferred', and the sources provide no technical details, proof of concept or vendor advisory text.
• The record does not specify the vulnerable parameter, endpoint or authentication requirements beyond the CVSS vector.
• The record does not list a fixed version explicitly, so the exact patched release must be confirmed.
• The 'n/a' lower bound in the affected range is unclear and may mean that all earlier versions are affected.

Frequently asked questions

What is CVE-2026-96809?

It is a blind SQL Injection (CWE-89) in the EduAdmin Booking WordPress plugin (eduadmin-booking), as reported by Patchstack. The record lists versions before 6.0.0 as affected.

How severe is it?

The record assigns a CVSS 3.1 score of 9.3, rated critical, based on the data provided by Patchstack.

Is it being exploited?

The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

What should administrators do?

Identify installations, update to version 6.0.0 or later once verified, and apply temporary access restrictions and monitoring while the update is pending.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.