WP Time Slots Booking Form EUVD-2026-36857

Exploitation requires a valid authenticated WordPress account with at minimum the Subscriber role (CVSS PR:L), the WP Time Slots Booking Form plugin installed and active at version 1.2.50 or earlier, and network reachability to the WordPress front-end or admin-ajax endpoint (AV:N/AC:L, no user interaction). Limiting factor: sites that disable open self-registration (Settings > General > Membership unchecked) materially raise the bar by forcing attackers to acquire credentials through other means; sites with registration enabled or with many low-trust accounts are effectively exposed to unauthenticated-equivalent attackers.

Signals are mixed: CVSS 3.1 base of 8.5 is high largely because of S:C and AV:N/AC:L, but PR:L means the attacker must already hold a valid Subscriber account - a low bar on sites with open registration, but a hard gate on sites with registration disabled. There is no KEV listing, no published POC referenced in the input, and EPSS data was not provided, so prioritization should hinge on whether the site permits self-registration and whether the plugin is installed and active. C:H/I:N/A:L is consistent with data exfiltration via UNION/blind SQLi rather than write or DoS primitives. Notable data gaps: EPSS score not supplied and the Patchstack reference is the sole source, so independent confirmation of the exact vulnerable parameter is unavailable.

An attacker registers a free Subscriber account on a WordPress site running WP Time Slots Booking Form 1.2.50 or earlier, authenticates, and sends a crafted request to one of the plugin's logged-in AJAX endpoints with a malicious SQL payload in a booking-related parameter. Because Scope is Changed, the injected query can reach the wp_users table and exfiltrate password hashes or session tokens belonging to administrators. No public POC is referenced in the input, but Subscriber-level SQLi flaws are routinely weaponized shortly after Patchstack disclosure.