Atomic Edge analysis of CVE-2026-1719 (metadata-based):
This vulnerability is an unauthenticated SQL Injection discovered in the Gravity Bookings Premium plugin for WordPress, affecting versions up to and including 2.5.9. The CVSS score is 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a high severity with confidentiality impact only. The vulnerability exists in the plugin’s handling of the ‘category_id’ parameter, allowing attackers without authentication to inject malicious SQL queries.
The root cause, based on the CWE-89 classification and vulnerability description, is improper neutralization of special elements used in an SQL command. The description states that there is insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is a classic SQL injection pattern where the ‘category_id’ parameter is likely used directly in a SQL query without being properly sanitized or parameterized. Atomic Edge analysis infers that the vulnerable code likely uses a construct like $wpdb->query(“SELECT … WHERE category_id = ” . $category_id) instead of using $wpdb->prepare() with a placeholder. This is inferred from the CWE and description; no code diff is available to confirm the exact line.
For exploitation, an unauthenticated attacker would target a publicly accessible endpoint that processes the ‘category_id’ parameter. Common WordPress plugin patterns for such an endpoint include an AJAX action (e.g., admin-ajax.php?action=gf_bookings_get_categories) or a REST API endpoint (e.g., /wp-json/gf-bookings/v1/categories). The attacker would submit a request with the ‘category_id’ parameter containing SQL injection payloads, such as ‘ UNION SELECT user_pass FROM wp_users– or ‘ AND 1=0 UNION SELECT database()–. The attack vector is network-based and requires no privileges, making it highly accessible. The following sections describe the exploitation method in detail.
Remediation requires changing the vulnerable SQL query to use prepared statements with parameterized queries. The WordPress $wpdb class provides $wpdb->prepare() which automatically escapes values and uses placeholders like %d or %s. The fix should ensure that the ‘category_id’ parameter is first sanitized as an integer (intval) or passed as a placeholder. Additionally, capability checks or nonce verification should be added if the endpoint is intended for authenticated users only.
If exploited, this vulnerability allows an unauthenticated attacker to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, and any other data stored in the database. This can lead to complete account takeover if an attacker cracks the password hashes, or further attacks against other services using the same credentials. The impact is constrained to confidentiality (data exposure) as per the CVSS vector, but successful exploitation could be a stepping stone to privilege escalation.
For the proof-of-concept, Atomic Edge research assumes a common plugin AJAX action: ‘gf_bookings_get_categories’ which accepts a ‘category_id’ parameter via POST. The PoC sends a request with a SQL injection payload to demonstrate the vulnerability. If the endpoint differs (e.g., a REST route), the PoC can be adapted similarly.
For the ModSecurity rule, Atomic Edge research blocks exploitation by matching the AJAX action parameter and detecting SQL injection patterns in the ‘category_id’ parameter. The rule uses @detectSQLi which is a nullary operator that performs SQL injection pattern matching on the parameter value. This approach is narrowly scoped to the specific action and parameter.
