PT-2026-37435 · WordPress · Gravity Bookings Premium

Abdulsamad Yusuf · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-1719

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gravity Bookings Premium versions prior to 2.6.0

Description The Gravity Bookings Premium plugin for WordPress contains a SQL Injection flaw caused by insufficient escaping of user-supplied parameters and a lack of proper preparation of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update the plugin to a version later than 2.5.9.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-1719

Affected Products

Gravity Bookings Premium

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1719 · Security Note
• https://twitter.com/CVEnew/status/2051997179871629405 · Twitter Post
• https://gravitybooking.com · Note
• https://twitter.com/infoflowcloud/status/2051998055621070863 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ce032abe-ee9d-4be1-ac97-5fa95d598e85?source=cve · Note
• https://twitter.com/KaitanSecurity/status/2051972752869904815 · Twitter Post