EUVD-2026-60787
GHSA-j77h-22x9-xwgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running JetAppointment <=2.5.2
-
DeliverySend crafted request to booking endpoint
-
ExploitInject SQL into unsanitized query
-
ExecutionRun blind/UNION extraction
-
ImpactDump user credentials and PII
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that a vulnerable JetAppointment installation (version <= 2.5.2) be reachable over the network with its booking/appointment functionality exposed to visitors, which is the plugin's default purpose. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction and no special privilege required - an attacker just needs to reach the injectable booking endpoint. Limiting factors are minimal: the site must have the plugin installed and active at an affected version, and any WAF/virtual patch or removal of public booking access in front of the endpoint would blunt the attack. No specific non-default configuration is stated as a prerequisite in the description. |
| Impact | The signals mostly align toward genuine priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L describes network reach, low complexity, no privileges and no user interaction - the classic profile of a scriptable, mass-exploitable web flaw, and SQL injection is highly automatable. Patchstack-reported WordPress plugin bugs are frequently folded into commodity scanning within days. Countervailing factors: no EPSS score was supplied, there is no KEV listing and no public POC is referenced, so exploitation remains theoretical rather than observed. The vendor-assigned vector is also internally unusual - it claims S:C (scope change) and A:L yet I:N, atypical for SQLi where injection often permits at least limited write/integrity impact; treat the confidentiality-dominant, low-availability shape as vendor characterization rather than independently verified. Net: high-priority to patch given unauthenticated network SQLi, but current real-world exploitation is unconfirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker browses to a WordPress site running JetAppointment and submits a crafted value in a booking request parameter that is concatenated into a backend SQL query. Using boolean or time-based blind techniques, they enumerate the database and dump wp_users password hashes and other PII, all without logging in. Because the flaw is network-reachable with low complexity and no user interaction, the request is trivially scriptable across many sites, though no public POC is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade JetAppointment to the first release above 2.5.2 published by Crocoblock; the affected range '<= 2.5.2' implies a fixed version exists but the exact patched build is not confirmed in the supplied data, so verify the current version on the Crocoblock/Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-appointments-booking/vulnerability/wordpress-jetappointment-plugin-2-5-2-sql-injection-vulnerability before relying on a specific number. Until the update is applied, place the site behind a WAF or Patchstack's virtual patch and add rules to block SQL metacharacters on the plugin's booking/appointment request parameters (trade-off: overly broad rules can break legitimate bookings containing apostrophes). As a stronger interim control, restrict or disable public access to the appointment-booking endpoints/pages if online self-service booking is not business-critical (trade-off: customers lose self-service scheduling), and monitor the WordPress database user's query logs for anomalous UNION, SLEEP or OR 1=1 patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is JetAppointment, a commercial appointment- and booking-management plugin from Crocoblock (JetImpex Inc.) built on top of the WordPress/WooCommerce/Elementor ecosystem. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input reaching a booking/appointment query is concatenated into SQL without adequate parameterization or sanitization, so an attacker-controlled value alters the query structure. Because the plugin exposes booking endpoints to unauthenticated visitors, the injectable parameter is reachable pre-authentication. The CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetappointment:*:*:*:*:*:*:*:* confirms the vendor and product but does not itself bound the fixed version.
Know when Jetappointment gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N) yields full DB read (C:H) and limited write (I:L); same DB authority so S:U.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
Executive ViewAI
The JetAppointments Booking plugin for WordPress contains a critical SQL injection vulnerability (CVSS 9.3) that allows unauthenticated attackers to extract sensitive database contents including user records and credentials without login. All versions up to 2.5.2 are affected with no patch currently available. Organizations using this plugin face immediate risk of customer data compromise and credential theft.
Disable the plugin if appointment booking is not business-critical. If required: implement Web Application Firewall with SQL injection detection rules specific to booking parameters; restrict database user account permissions to minimum necessary privileges; enable real-time database query auditing and alerting on suspicious patterns; segment booking infrastructure on separate database user account with read-only access to non-sensitive tables; require multi-factor authentication for all administrative access to WordPress; implement IP-based access controls limiting booking endpoints to known organizational networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB