CVE-2026-22336 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection (SQLi) in **Directorist Booking** plugin. <br>💥 **Consequences**: Attackers can manipulate SQL commands via improper handling of special characters.…

🛡️ **Root Cause**: **CWE-89** (Improper Neutralization of Special Elements used in an SQL Command).…

📦 **Affected Product**: **Directorist Booking** (WordPress Plugin). <br>📉 **Versions**: All versions **prior to 3.0.2**. <br>🌐 **Context**: Affects WordPress sites using this specific booking plugin.

🕵️ **Attacker Capabilities**: <br>1. **Read**: Extract sensitive data (user credentials, bookings, personal info). <br>2. **Write**: Modify or delete database records. <br>3.…

🔓 **Exploitation Threshold**: **LOW**. <br>📊 **CVSS**: AV:N (Network), AC:L (Low Complexity), PR:N (No Privileges Required), UI:N (No User Interaction).…

🧪 **Public Exploit**: **No**. <br>📝 **Status**: The `pocs` field is empty in the provided data. While the vulnerability is confirmed, no specific Proof-of-Concept (PoC) code is publicly listed in this dataset.

🔍 **Self-Check**: <br>1. **Scan**: Use vulnerability scanners to detect **Directorist Booking** version. <br>2. **Verify**: Check if version < **3.0.2**. <br>3.…

🩹 **Official Fix**: **YES**. <br>✅ **Solution**: Upgrade **Directorist Booking** to version **3.0.2** or later. <br>🔗 **Reference**: Patchstack database entry confirms the fix availability.

🛑 **No Patch Workaround**: <br>1. **Disable**: Deactivate/Deactivate the **Directorist Booking** plugin immediately. <br>2. **WAF**: Deploy a Web Application Firewall to block SQL injection patterns. <br>3.…

⚠️ **Urgency**: **HIGH**. <br>🚀 **Priority**: **P1**. <br>💡 **Reason**: Critical severity (C:H), easy exploitation (AC:L, PR:N), and wide attack surface (Network).…