What is the CVSS score of CVE-2026-73365?

CVE-2026-73365 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of JetAppointment are affected by CVE-2026-73365?

The JetAppointments Booking plugin for WordPress contains a critical SQL injection vulnerability (CVSS 9.3) that allows unauthenticated attackers to extract sensitive database contents including user…

How to fix or mitigate CVE-2026-73365?

Within 24 hours: audit all WordPress installations for JetAppointment plugin presence and version; document business criticality of appointment booking functionality. Within 7 days: implement network-level access controls restricting booking workflow endpoints to authorized users, deploy Web Application Firewall rules blocking SQL injection patterns (focus on booking parameters), enable database activity monitoring and query logging, and restrict database user privileges to limit data exfiltration scope. Within 30 days: monitor Crocoblock security advisories for patch release; evaluate alternative appointment booking solutions (e.g., Calendly, Acuity Scheduling) as replacement candidates; develop timeline for plugin deactivation and data migration if patching timeline extends beyond 60 days.

JetAppointment CVE-2026-73365

EUVD-2026-60787 CRITICAL

SQL Injection (CWE-89)

2026-08-18 Patchstack

GHSA-j77h-22x9-xwgc

SQLi Jetappointment

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N) yields full DB read (C:H) and limited write (I:L); same DB authority so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:02 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

AnalysisAI

SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify site running JetAppointment <=2.5.2

Delivery

Send crafted request to booking endpoint

Exploit

Inject SQL into unsanitized query

Execution

Run blind/UNION extraction

Impact

Dump user credentials and PII

Access

Identify site running JetAppointment <=2.5.2

Delivery

Send crafted request to booking endpoint

Exploit

Inject SQL into unsanitized query

Execution

Run blind/UNION extraction

Impact

Dump user credentials and PII

Vulnerability AssessmentAI

Exploitation	Exploitation requires only that a vulnerable JetAppointment installation (version <= 2.5.2) be reachable over the network with its booking/appointment functionality exposed to visitors, which is the plugin's default purpose. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals mostly align toward genuine priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L describes network reach, low complexity, no privileges and no user interaction - the classic profile of a scriptable, mass-exploitable web flaw, and SQL injection is highly automatable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker browses to a WordPress site running JetAppointment and submits a crafted value in a booking request parameter that is concatenated into a backend SQL query. Using boolean or time-based blind techniques, they enumerate the database and dump wp_users password hashes and other PII, all without logging in. …
Remediation	Upgrade JetAppointment to the first release above 2.5.2 published by Crocoblock; the affected range '<= 2.5.2' implies a fixed version exists but the exact patched build is not confirmed in the supplied data, so verify the current version on the Crocoblock/Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-appointments-booking/vulnerability/wordpress-jetappointment-plugin-2-5-2-sql-injection-vulnerability before relying on a specific number. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: audit all WordPress installations for JetAppointment plugin presence and version; document business criticality of appointment booking functionality. …

Threat intelligence, references, and detailed analysis are available after sign-in.