What is the CVSS score of CVE-2026-68566?

CVE-2026-68566 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-68566?

Within 24 hours: Inventory all WordPress installations running BookingPress Pro versions ≤6.0.2 and immediately disable the plugin or restrict access to booking workflow endpoints via firewall rules. Within 7 days: Monitor Repute Infosystems' security advisory for patch release and upgrade to the first patched version when available; if no patch emerges, deploy Web Application Firewall rules to block SQL injection patterns in booking requests. Within 30 days: Verify all instances have been remediated, conduct a database audit for unauthorized access or data exfiltration during the exposure window, and implement continuous monitoring for BookingPress Pro security updates.

BookingPress Pro CVE-2026-68566

EUVD-2026-63309 CRITICAL

SQL Injection (CWE-89)

2026-08-20 Patchstack

GHSA-23c8-qpfv-5g5x

WordPress SQLi Wordpress Plugin Bookingpress Appointment Booking Pro Repute Infosystems

9.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Fingerprint WordPress site running BookingPress Pro
Delivery

Send crafted request to booking endpoint
Exploit

Inject SQL via unsanitized parameter
Execution

Database executes malicious query
Impact

Exfiltrate credentials and sensitive data

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The only prerequisite is that a target WordPress site has BookingPress Appointment Booking Pro version 6.0.2 or earlier installed and active, with the vulnerable booking endpoint network-reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, unauthenticated, and requires no user interaction, so against a default installation of the vulnerable plugin no special configuration is needed. The chief limiting factor is simply deployment: the paid 'Pro' edition must be present (the free BookingPress edition is out of scope of this CVE), and sites already on a fixed release or with the plugin deactivated are not exploitable.
Impact	The signals point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated, no-interaction exploitation, which is the profile most likely to be mass-scanned once details or a PoC circulate. The confidentiality impact is High (database read), while integrity is rated None and availability only Low, so the primary realistic outcome is data theft rather than full site takeover - though SQLi frequently enables credential/session extraction that can escalate. Tempering the urgency: EPSS is not provided, the CVE is not listed in CISA KEV, and no public exploit has been identified, so exploitation is currently theoretical rather than observed. Even so, given WordPress plugins are routinely targeted by automated botnets, any organization running BookingPress Pro <= 6.0.2 should treat patching as urgent and not wait for a KEV listing. The scope-changed (S:C) rating in the source vector is worth verifying, as typical SQLi stays within the database security scope.
Exploit ScenarioDerived	An attacker discovers a WordPress site running BookingPress Pro <= 6.0.2 via plugin fingerprinting, then sends a crafted HTTP request to the vulnerable booking endpoint with a malicious SQL payload in a booking parameter - no login or user interaction required (AV:N/AC:L/PR:N/UI:N). The injected query returns database contents such as user records, WordPress password hashes, or API keys, which the attacker uses for further compromise. No public exploit is identified at time of analysis, so this would require the attacker to develop their own payload.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 20, 2026

SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets remote, unauthenticated attackers inject arbitrary SQL through the booking workflow, per Patchstack (CVSS 9.3, CWE-89). Because the flaw is reachable without authentication or user interaction (PR:N/UI:N), any WordPress site running the vulnerable Pro plugin is exposed to database compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so this is a high-severity-but-not-yet-weaponized issue.

RemediationAI

No vendor-released patched version is identified in the provided data, so the exact fix version must be confirmed from the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/bookingpress-appointment-booking-pro/vulnerability/wordpress-bookingpress-appointment-booking-pro-plugin-6-0-2-sql-injection-vulnerability) and the vendor; upgrade to the first release above 6.0.2 as soon as it is available. Until then, apply a Web Application Firewall virtual patch or Patchstack's vPatch to block SQL-injection payloads against the plugin's AJAX/REST booking endpoints (trade-off: WAF rules can miss novel encodings and may false-positive on legitimate bookings). As a stronger interim control, deactivate the BookingPress Pro plugin, which removes the exposure entirely at the cost of taking the online booking feature offline; alternatively restrict access to the booking pages/admin-ajax handlers at the network or authentication layer where feasible. Also review database and web logs for anomalous UNION/SLEEP-style query patterns to detect prior exploitation.

Affected VersionsENISA

BookingPress Appointment Booking Pro n/a ≤6.0.2

Affected Packages

euvd bookingpress_appointment_booking_pro no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is BookingPress Appointment Booking Pro, a commercial WordPress plugin (CPE cpe:2.3:a:repute_infosystems:bookingpress_appointment_booking_pro) that manages online appointment scheduling, services, and payments. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaching the booking/appointment queries is concatenated into SQL statements without proper parameterization or sanitization. In WordPress plugins this class of bug most commonly surfaces through AJAX handlers (admin-ajax.php) or REST endpoints that accept booking parameters and pass them to $wpdb queries without prepared statements, allowing an attacker to alter query logic against the site's MySQL/MariaDB database.

Know when Bookingpress Appointment Booking Pro gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI 7.5 HIGH

Remote unauthenticated SQLi with no interaction gives AV:N/AC:L/PR:N/UI:N and C:H for database read; I:N and A:N follow the source impact ratings, and SQLi normally stays in-scope so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

DescriptionCVE.org

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.

Executive ViewAI

Why It Matters

BookingPress Appointment Booking Pro for WordPress versions 6.0.2 and earlier contain a critical SQL injection vulnerability (CVSS 9.3) enabling unauthenticated attackers to access customer booking data and compromise site databases. No public exploit code has been identified at time of analysis; however, the lack of authentication requirements means all WordPress sites running this plugin face immediate risk. No vendor patch is currently available, requiring urgent mitigation action.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable the plugin entirely or restrict database account privileges for the application user, implement WAF rules blocking SQL injection syntax in POST requests to booking endpoints, enable and review database query logging for suspicious activity, implement database integrity monitoring for booking and customer tables, rate-limit the booking workflow to slow exploitation attempts, and temporarily suspend booking functionality if exposure cannot be controlled otherwise.

Threat Intelligence Overview

EPSS Score

0.3%

Top 78% exploitable

Prevalence

Medium

commercial WordPress appointment-booking plugin, moderate paid install base

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.