What is the CVSS score of CVE-2026-13454?

CVE-2026-13454 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

MotoPress Appointment Booking CVE-2026-13454

EUVD-2026-40938 MEDIUM

SQL Injection (CWE-89)

2026-07-01 Wordfence

GHSA-5rm9-ph95-q938

WordPress SQLi Wordpress Plugin Motopress Appointment Booking Jetmonsters

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable via admin web interface; PR:L reflects mandatory mpa_appointment_employee role; read-only SQLi yields C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 09:50 vuln.today

CVE Published

Jul 01, 2026 - 08:30 cve.org

MEDIUM 6.5

DescriptionCVE.org

The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the mpa_appointment_employee custom role, meaning any user assigned this role can perform the attack.

AnalysisAI

SQL Injection in the MotoPress Appointment Booking WordPress plugin (versions ≤ 2.4.5) allows authenticated attackers holding the mpa_appointment_employee custom role to append arbitrary SQL to booking search queries via the 's' parameter, enabling full read access to the underlying WordPress database. The vulnerability originates in ManageBookingsPage.php at two separate query-construction points (lines 247 and 310), where user-supplied input is neither escaped nor parameterized. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not supplied; however, the Wordfence intelligence report and a confirmed upstream fix commit indicate the issue is credibly documented.

Technical ContextAI

The affected component is ManageBookingsPage.php within the motopress-appointment-lite WordPress plugin (CPE: cpe:2.3:a:jetmonsters:motopress_appointment_booking:*:*:*:*:*:*:*:*), developed by JetMonsters. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). At lines 247 and 310 of ManageBookingsPage.php, the plugin constructs dynamic SQL queries incorporating the 's' search parameter without applying WordPress's $wpdb->prepare() mechanism or equivalent escaping, allowing an attacker to alter query logic. This is a classic second-order or inline SQLi pattern common in WordPress plugin development where developers manually concatenate user input into SQL strings rather than using prepared statements with bound parameters.

RemediationAI

An upstream fix has been committed to the plugin trunk via WordPress plugin repository changeset 3591693 (https://plugins.trac.wordpress.org/changeset/3591693/motopress-appointment-lite/trunk/includes/admin-pages/manage/ManageBookingsPage.php); however, an exact released patched version number is not independently confirmed in the available data - administrators should update to the latest available version via the WordPress plugin dashboard and verify the changelog for a post-2.4.5 release. As a compensating control pending upgrade, administrators should audit which users hold the mpa_appointment_employee custom role and revoke it from any accounts where it is not operationally necessary, directly eliminating the exploitable principal set. Additionally, a WordPress application firewall rule targeting SQL metacharacters in the 's' parameter on booking management admin pages can provide detection and blocking capability without disrupting normal operations. Database read permissions for the WordPress database user should be scoped to only the tables required by the plugin if not already minimized.