Critical vulnerabilities13 Nov 2026, 15:19 UTC

4 critical vulnerabilities in 4 WordPress plugins

4 vulnerabilities rated critical (CVSS 9.0 or higher) found on 13 November 2026: Arbitrary file upload in WordPress plugins, PHP object injection in WordPress plugins, SQL injection in WordPress plugins.

4 critical

Arbitrary file upload in Hotel Booking Lite · WordPress plugins

CVE-2026-125851

WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability

Severity: Critical 9.9
Published: 13 Nov 2026
Weakness: Unrestricted file upload (CWE-434)
Attack: Over the network · Needs a user account · No user action needed
Attacker can: Read data · Change data · Take it down

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1.

From the CVE Program.

Software	Affected versions
Hotel Booking Lite (WordPress plugin)WordPress plugins	Every version up to 2.5.1
Hotel Booking Lite (WordPress theme)WordPress themes	Every version up to 2.5.1

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-125851

Everything about CVE-2026-125851

PHP object injection in ELEX WordPress HelpDesk & Customer Ticketing System · WordPress plugins

CVE-2026-125855

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability

Severity: Critical 9.8
Published: 13 Nov 2026
Weakness: Deserialization of untrusted data (CWE-502)
Attack: Over the network · No login needed · No user action needed
Attacker can: Read data · Change data · Take it down

Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9.

From the CVE Program.

Software	Affected versions
Elex Helpdesk Customer Support Ticket System (WordPress plugin)WordPress plugins	Every version up to 3.3.9

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-125855

Everything about CVE-2026-125855

SQL injection in Alex Reservations · WordPress plugins

CVE-2026-124415

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Severity: Critical 9.3
Published: 13 Nov 2026
Weakness: SQL injection (CWE-89)
Attack: Over the network · No login needed · No user action needed
Attacker can: Read data · Slow it down

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

From the CVE Program.

Software	Affected versions
Alex Reservations (WordPress plugin)WordPress plugins	Every version up to 2.4.8

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124415

Everything about CVE-2026-124415

SQL injection in WP BASE Booking · WordPress plugins

CVE-2026-124970

WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability

Severity: Critical 9.3
Published: 13 Nov 2026
Weakness: SQL injection (CWE-89)
Attack: Over the network · No login needed · No user action needed
Attacker can: Read data · Slow it down

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2.

From the CVE Program.

Software	Affected versions
WP Base Booking Of Appointments Services And Events (WordPress plugin)WordPress plugins	Every version up to 6.5.2

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124970

Everything about CVE-2026-124970

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.