EUVD-2026-40912
GHSA-6qfc-c5qp-6g6q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network POST with no interaction (AV:N/AC:L/PR:N/UI:N); read-only data extraction gives C:H with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Articles & Coverage 1
AnalysisAI
SQL injection in the BookingPress Appointment Booking Pro WordPress plugin (versions up to and including 5.7.1) allows unauthenticated attackers to inject SQL through the 'store_service_date' POST parameter of the bpa_assign_staffmember_to_slots() function, enabling extraction of sensitive database contents such as user credentials and PII. The flaw stems from stripslashes_deep() being applied to user input before it is concatenated directly into a LIKE clause without $wpdb->prepare(). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
Technical ContextAI
The affected component is a commercial WordPress appointment-scheduling plugin (CPE cpe:2.3:a:repute_infosystems:bookingpress_appointment_booking_pro) built on WordPress's $wpdb database abstraction layer. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Normally WordPress adds slashes to superglobal input; here the developer explicitly calls stripslashes_deep() on the POST data, stripping the very escaping that would have neutralized quote characters, then interpolates the value verbatim into a SQL LIKE clause without $wpdb->prepare() or any parameterization. Because the injection sits inside a LIKE pattern in a live query, an attacker can append additional SQL (e.g. UNION-based subqueries) to read arbitrary tables. The vulnerable code is visible in class.bookingpress_pro_staff_members.php around line 3353.
RemediationAI
No vendor-released patch version was identified in the provided data, so upgrade to the first release after 5.7.1 once the vendor publishes it and confirm the fix via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1663be8e-a6b8-4e0d-97d0-af7db2a2875c?source=cve). As compensating controls until a patched version is confirmed, place a WAF rule (such as Wordfence's) in front of the site to block SQL metacharacters in the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() endpoint; restrict or rate-limit access to the plugin's AJAX/booking endpoints - noting this may break legitimate booking flows for anonymous visitors; and if the plugin is not actively used, deactivate and remove it, which eliminates the exposure entirely at the cost of the booking feature. Ensure database accounts used by WordPress have least-privilege access to limit the scope of any data extraction.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today