What is the CVSS score of CVE-2026-61949?

CVE-2026-61949 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Bookly are affected by CVE-2026-61949?

Bookly WordPress plugin (versions 27.7 and earlier) contains a critical SQL injection vulnerability accessible without authentication, exposing the entire WordPress database to extraction.

How to fix or mitigate CVE-2026-61949?

Within 24 hours, audit all WordPress installations for Bookly versions 27.7 and earlier and immediately disable the plugin on production systems. Within 7 days, deploy Web Application Firewall rules to filter SQL injection patterns targeting Bookly endpoints and enable database activity monitoring to identify any exploitation attempts. Within 30 days, upgrade to a patched Bookly version once released by the vendor or migrate to an alternative appointment-booking solution, and conduct forensic review of database access logs with credential rotation for any exposed accounts.

Bookly CVE-2026-61949

EUVD-2026-48207 CRITICAL

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-frmr-fpp8-95g2

WordPress SQLi Bookly Wordpress Plugin

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated remote SQLi over the network (AV:N/AC:L/PR:N/UI:N); read access to the full database gives C:H with changed scope, integrity unaffected and only minor availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:40 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Bookly <= 27.7 versions.

AnalysisAI

SQL injection in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through a plugin request, carrying a CVSS 3.1 base score of 9.3 (AV:N/PR:N with a changed scope and high confidentiality impact). Because Bookly is a public-facing booking form reachable by any site visitor, the flaw exposes the entire WordPress database to extraction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Bookly is a widely used WordPress plugin (marketed as the 'Bookly responsive appointment booking tool') that provides online scheduling, calendars, and payment integration; it runs inside PHP/WordPress and stores appointments, customers, and staff records in the shared MySQL/MariaDB database. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a database query without proper parameterization or escaping. The affected component is identified only by CPE cpe:2.3:a:bookly:bookly:*:*:*:*:*:*:*:*, covering all builds up to and including 27.7; the CVSS 'Scope: Changed' metric indicates the injected query can reach data beyond the plugin's own tables - the full WordPress schema, including wp_users password hashes and secret keys.

RemediationAI

Upgrade Bookly to the first vendor release above 27.7 that addresses this issue; the input data does not include an exact fixed version, so verify the patched build via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/bookly-responsive-appointment-booking-tool/vulnerability/wordpress-bookly-plugin-27-7-sql-injection-vulnerability) and the plugin changelog before deploying. Until patched, place the site behind a WAF or Patchstack virtual patch with rules blocking SQL metacharacters on the Bookly AJAX/booking endpoints, restrict or temporarily disable the public booking form if business-tolerable, and rotate database credentials and WordPress secrets/salts if compromise is suspected, since the changed-scope confidentiality impact implies potential exposure of wp_users hashes. Note that WAF filtering can generate false positives on legitimate booking data and disabling the form removes customer self-service, so treat these as stopgaps until the upgrade is applied.