CVE-2026-124415Alejandro Alex Reservations

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.3of 10, critical

010

Exploited in the wild: Not confirmedBy CISA
Chance of exploitation: Not scored yetEPSS, next 30 days
Used in ransomware: Not known
US federal deadline: None set

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124415. Nothing runs until you send it.

About this flaw

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

Published: 13 Nov 2026
Weakness: CWE-89

What should I do about this?

Advisories and references

patchstack.compatchstack.com/database/wordpress/plugin/alex-reservations/vulnerability/wordpress-alex-reservations-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve