CVE-2026-61949— WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

CVSS 9.3 · Critical EPSS 0.28% · P21 Updated Jul 24, 2026

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Bookly	Bookly	`n/a≤ 27.7`	affected

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-61949

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

Unauthenticated SQL Injection in Bookly <= 27.7 versions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Vulnerability Title

Bookly SQL注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Bookly是Bookly公司的一个图书预约管理软件。 Bookly 27.7及之前版本存在SQL注入漏洞，该漏洞源于容易受到未经验证的SQL注入攻击。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Bookly	Bookly	n/a ~ 27.7	-

II. Public POCs for CVE-2026-61949

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-61949

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-61949

IV. Related Vulnerabilities

Same product: Bookly

Same vendor: Bookly

Same weakness: CWE-89

V. Comments for CVE-2026-61949

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-61949— WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Possible ATT&CK Techniques 1AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-61949

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-61949

III. Intelligence Information for CVE-2026-61949

IV. Related Vulnerabilities

V. Comments for CVE-2026-61949

Leave a comment