PT-2026-35391 · WordPress · Directorist Booking

0Xd4Rk5Id3 · Published 2026-04-27 · Updated 2026-06-16 · CVE-2026-22336

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Directorist Booking versions prior to 3.0.2

Description Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) allows an attacker to interfere with the queries that an application makes to its database. This can lead to unauthorized access to sensitive data or modification of database records.

Recommendations Update to version 3.0.2 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-22336

Affected Products

Directorist Booking

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-22336 · Security Note
• https://i.redd.it/bnzlprdlcj7h1.png · Reddit Post
• https://t.me/cveNotify/161043 · Telegram Post
• https://twitter.com/CVEnew/status/2048852209094246672 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/directorist-booking/vulnerability/wordpress-directorist-booking-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/51921 · Telegram Post