BookingPress Appointment Booking Pro CVE-2026-11823

Exploitation requires only that a target WordPress site have BookingPress Appointment Booking Pro version 5.7.1 or earlier installed and active, with the AJAX endpoint invoking bpa_assign_staffmember_to_slots() reachable over the network. The concrete prerequisite is the ability to send POST data to that function's 'store_service_date' parameter - no authentication, no privileges, and no user interaction are needed (PR:N/UI:N confirmed by CVSS). The main limiting factors are that the specific vulnerable plugin and version must be deployed and the booking endpoint must be publicly accessible (not gated behind login, IP allowlisting, or a WAF); impact is confined to confidentiality (data read), as the CVSS shows no integrity or availability impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, high confidentiality impact only (no integrity or availability impact, consistent with a read-oriented data-extraction SQLi). The unauthenticated, no-interaction nature makes this attractive for opportunistic mass scanning of WordPress sites once the specific parameter and endpoint are known. Tempering factors: no EPSS probability was supplied, the CVE is not in CISA KEV, and no public POC has been identified - so this is currently a high-severity but not confirmed-exploited issue. The report originates from Wordfence, a credible WordPress security source, which raises confidence in the technical accuracy. Net priority: high for any site running the plugin, driven by the unauthenticated confidentiality impact rather than by evidence of in-the-wild activity.

An unauthenticated attacker sends a crafted HTTP POST request to the plugin's staff-assignment handler with SQL payload embedded in the 'store_service_date' field. Because stripslashes_deep() removes escaping and the value is concatenated into a LIKE clause, the appended query executes, returning contents of tables such as wp_users, allowing the attacker to exfiltrate password hashes, email addresses, and other sensitive data. No public POC has been identified, but the low attack complexity and lack of authentication make exploitation straightforward for someone who reconstructs the request.