CVE-2026-49073: Blind SQL Injection in wpWax Directorist Booking

Technical summary

CVE-2026-49073 is a blind SQL injection vulnerability (CWE-89) in wpWax Directorist Booking caused by improper neutralization of special SQL elements in user-controlled input. The vulnerability requires valid authentication (CVSS vector indicates PR:L), meaning an attacker must possess legitimate credentials. Blind SQL injection allows inference-based data extraction through time-based or boolean-based techniques, even when query results are not directly returned to the user. The network-accessible nature (AV:N) and low attack complexity (AC:L) make this a practical threat in multi-tenant or shared hosting environments where attackers may obtain basic user accounts.

Business impact

Organizations relying on Directorist Booking for directory or booking functionality face exposure of sensitive business and user data, including customer records, contact information, and potentially payment-related metadata. The confidentiality impact is rated high in the CVSS vector, meaning complete information disclosure is possible. Although integrity impact is not listed, the ability to execute arbitrary SQL can enable data manipulation in some blind SQL injection scenarios. The scope change (S:C) indicates potential impact beyond the vulnerable component, such as cross-database or system-level compromise in shared environments.

Affected systems

wpWax Directorist Booking versions through 3.0.3 are vulnerable. Organizations should verify their installed version and confirm whether the plugin is active on any WordPress instances. The plugin is commonly used for business directories, classified listings, and booking management, making it relevant across real estate, services, and marketplace deployments.

Exploitability

Exploitation requires valid login credentials, which raises the barrier compared to unauthenticated attacks but remains realistic in environments with permissive user registration, leaked credentials, or insider threats. Blind SQL injection exploitation is deterministic but time-consuming, typically requiring automated tools to craft inference-based payloads. No public exploit code or active exploitation in the wild is indicated by the KEV status (not listed). However, the straightforward nature of SQL injection (low AC) suggests weaponization risk once technical details circulate.

Remediation

Upgrade wpWax Directorist Booking to a patched version released after 3.0.3. Consult the wpWax security advisories or vendor release notes to confirm the minimum patched version. As an interim control, restrict user registration to trusted parties only and enforce strong access controls on booking plugin administrative functions. Database query logging and Web Application Firewall rules targeting SQL injection patterns (e.g., UNION-based, time-delay syntax) can detect exploitation attempts.

Patch guidance

Check the wpWax Directorist plugin repository or vendor security page for version 3.0.4 or later, which should include SQL injection input validation fixes. Before updating, test in a staging environment to confirm compatibility with your WordPress version and any custom extensions. Automated patching tools (WordPress plugin auto-update, managed hosting control panels) can expedite deployment. Verify patch application by confirming the updated version in your WordPress admin dashboard.

Detection guidance

Monitor web server and database logs for SQL injection attack signatures: keyword sequences like SLEEP(), BENCHMARK(), WAITFOR, UNION SELECT, or SQL comment characters (-- , /* */) in booking-related plugin requests. Implement database query audit logging to capture any anomalous queries executed by the plugin's database user. Use security plugins (Wordfence, Sucuri) to scan for malicious SQL patterns in request payloads. Periodically review user access logs to identify suspicious authentication patterns or privilege escalation.

Why prioritize this

This vulnerability merits high priority due to its high CVSS score (8.5), confirmed data confidentiality impact, and the prevalence of SQL injection in real-world breach chains. Although authentication is required, it does not eliminate risk in environments with weak access controls. The scope change indicates potential for lateral movement or multi-tenant compromise. Organizations using Directorist Booking should treat this as a critical patch candidate.

Risk score, explained

The CVSS 3.1 score of 8.5 reflects high confidentiality impact (complete information disclosure possible), low attack complexity (SQL injection is straightforward to execute), network accessibility, and scope change (affecting systems beyond the application). The requirement for prior authentication (PR:L) prevents a critical rating but still indicates substantial risk. The low availability impact reflects potential DoS through resource-intensive queries rather than outright service shutdown.

Frequently asked questions