CVE-2026-49073

HighCVSS 8.5/10Last modified Oct 26, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection.

This issue affects Directorist Booking: from n/a through 3.0.3.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
wpWaxDirectorist Booking<= 3.0.3

References

Timeline

Published
Jun 17, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-490747.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.CVE-2026-490759.8Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.CVE-2026-490769.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allowsCVE-2026-490775.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve EmCVE-2026-490787.5Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.CVE-2026-490799.3Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.CVE-2026-49089.8A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.pCVE-2026-490809.3Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.CVE-2026-490818.2Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.CVE-2026-490827.4Subscriber Sensitive Data Exposure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; ChatCVE-2026-490837.5Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.CVE-2026-490849.3Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.
CVE-2026-49073: High severity, CVSS 8.5 | Vulnix