EUVD-2026-40912
GHSA-6qfc-c5qp-6g6q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network POST with no interaction (AV:N/AC:L/PR:N/UI:N); read-only data extraction gives C:H with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Articles & Coverage 1
AnalysisAI
SQL injection in the BookingPress Appointment Booking Pro WordPress plugin (versions up to and including 5.7.1) allows unauthenticated attackers to inject SQL through the 'store_service_date' POST parameter of the bpa_assign_staffmember_to_slots() function, enabling extraction of sensitive database contents such as user credentials and PII. The flaw stems from stripslashes_deep() being applied to user input before it is concatenated directly into a LIKE clause without $wpdb->prepare(). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
Technical ContextAI
The affected component is a commercial WordPress appointment-scheduling plugin (CPE cpe:2.3:a:repute_infosystems:bookingpress_appointment_booking_pro) built on WordPress's $wpdb database abstraction layer. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Normally WordPress adds slashes to superglobal input; here the developer explicitly calls stripslashes_deep() on the POST data, stripping the very escaping that would have neutralized quote characters, then interpolates the value verbatim into a SQL LIKE clause without $wpdb->prepare() or any parameterization. Because the injection sits inside a LIKE pattern in a live query, an attacker can append additional SQL (e.g. UNION-based subqueries) to read arbitrary tables. The vulnerable code is visible in class.bookingpress_pro_staff_members.php around line 3353.
RemediationAI
No vendor-released patch version was identified in the provided data, so upgrade to the first release after 5.7.1 once the vendor publishes it and confirm the fix via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1663be8e-a6b8-4e0d-97d0-af7db2a2875c?source=cve). As compensating controls until a patched version is confirmed, place a WAF rule (such as Wordfence's) in front of the site to block SQL metacharacters in the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() endpoint; restrict or rate-limit access to the plugin's AJAX/booking endpoints - noting this may break legitimate booking flows for anonymous visitors; and if the plugin is not actively used, deactivate and remove it, which eliminates the exposure entirely at the cost of the booking feature. Ensure database accounts used by WordPress have least-privilege access to limit the scope of any data extraction.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific nam
Unauthenticated arbitrary file upload in the BookingPress Pro WordPress plugin (versions ≤5.6) enables remote code execu
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today