PT-2026-24674 · Crocoblock · Jetbooking

Hoshino · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-3496

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBooking versions up to and including 4.0.3

Description The JetBooking plugin for WordPress is susceptible to SQL Injection through the check in date parameter. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially enabling them to extract sensitive information from the database.

Recommendations Versions prior to 4.0.4 are affected. Update JetBooking to version 4.0.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3496

Affected Products

Jetbooking

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-3496 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/35e33e30-e102-445a-99d0-27adb7fc4638?source=cve · Note
• https://twitter.com/CVEnew/status/2033194295403204940 · Twitter Post
• https://twitter.com/RedPacketSec/status/2031967711874482279 · Twitter Post
• https://t.me/CVEtracker/47130 · Telegram Post
• https://crocoblock.com/changelog/?plugin=jet-booking · Note