PT-2026-24674 · Crocoblock · Jetbooking

Hoshino · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-3496

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBooking versions up to and including 4.0.3

Description The JetBooking plugin for WordPress is susceptible to SQL Injection through the check in date parameter. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially enabling them to extract sensitive information from the database.

Recommendations Versions prior to 4.0.4 are affected. Update JetBooking to version 4.0.4 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-3496

Produtos afetados

Jetbooking

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/35e33e30-e102-445a-99d0-27adb7fc4638?source=cve · Nota
• https://twitter.com/CVEnew/status/2033194295403204940 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2031967711874482279 · Publicação no Twitter
• https://t.me/CVEtracker/47130 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-3496 · Nota de Segurança
• https://crocoblock.com/changelog/?plugin=jet-booking · Nota