What is the CVSS score of CVE-2026-13395?

CVE-2026-13395 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Online Scheduling Plugin are affected by CVE-2026-13395?

The SQL injection vulnerability in the Online Scheduling and Appointment Booking System WordPress plugin (pre-27.8) exposes WordPress user credentials and sensitive database contents to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-13395?

Yes, a public proof-of-concept exploit is available for CVE-2026-13395. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-13395?

Within 24 hours: conduct an inventory of all WordPress installations using the Online Scheduling and Appointment Booking System plugin and verify current version numbers; prioritize instances accessible from the internet. Within 7 days: update the plugin to version 27.8 or later across all affected WordPress sites, beginning with customer-facing and internet-exposed systems, and confirm successful deployment through plugin version verification. Within 30 days: complete updates on all remaining installations, initiate a password audit for WordPress user accounts on systems that ran vulnerable versions, and review database access logs for unauthorized query activity or anomalies during the period of vulnerability.

Online Scheduling Plugin CVE-2026-13395

EUVD-2026-51013 HIGH

SQL Injection (CWE-89)

2026-07-30 WPScan

GHSA-q72x-7f87-fq74

WordPress Information Disclosure SQLi Online Scheduling And Appointment Booking System Unknown

8.6

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); reads data across the DB beyond the plugin's scope (S:C, C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:35 vuln.today

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

HIGH 8.6

DescriptionCVE.org

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

AnalysisAI

SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.

Technical ContextAI

The affected component is a WordPress plugin providing appointment scheduling and booking, which processes front-end booking requests from anonymous site visitors. The root cause is CWE-89 (SQL Injection): a parameter received from an unauthenticated booking request is concatenated or interpolated into a SQL statement without sanitization or correct numeric casting, so an attacker can break out of the intended query context and inject arbitrary SQL. Because WordPress stores account credentials as salted hashes in the wp_users table, a successful injection permits UNION-style or blind extraction of those password hashes and other stored data. The CPE identifies the affected package as online_scheduling_and_appointment_booking_system (vendor listed as 'unknown' in NVD's dictionary).

RemediationAI

Vendor-released patch: upgrade the Online Scheduling and Appointment Booking System plugin to version 27.8 or later, which addresses the missing sanitization and type-casting of the booking parameter. Apply this update from the WordPress plugin admin immediately, as the fix version is the primary and definitive remediation. If patching cannot be done at once, apply compensating controls: place a WAF rule (or ModSecurity CRS) to block SQL metacharacters in the affected front-end booking request parameters; temporarily disable or restrict access to the public booking endpoint (accepting that legitimate visitors will be unable to book while it is disabled); and rotate WordPress user passwords and any reused database credentials after patching, since password hashes may already have been exfiltrated. Reference the WPScan advisory (https://wpscan.com/vulnerability/87e75d83-0ffc-4dd1-8839-1d5a90f5ea73/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-13395) for details.