Bookingpress Appointment Booking Pro
Monthly
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets remote, unauthenticated attackers inject arbitrary SQL through the booking workflow, per Patchstack (CVSS 9.3, CWE-89). Because the flaw is reachable without authentication or user interaction (PR:N/UI:N), any WordPress site running the vulnerable Pro plugin is exposed to database compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so this is a high-severity-but-not-yet-weaponized issue.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
SQL injection in the BookingPress Appointment Booking Pro WordPress plugin (versions up to and including 5.7.1) allows unauthenticated attackers to inject SQL through the 'store_service_date' POST parameter of the bpa_assign_staffmember_to_slots() function, enabling extraction of sensitive database contents such as user credentials and PII. The flaw stems from stripslashes_deep() being applied to user input before it is concatenated directly into a LIKE clause without $wpdb->prepare(). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
Unauthenticated arbitrary file upload in the BookingPress Pro WordPress plugin (versions ≤5.6) enables remote code execution by abusing missing file type validation in the bookingpress_validate_submitted_booking_form_func function. Exploitation requires the booking form to include a signature custom field, but otherwise needs no authentication or user interaction. No public exploit identified at time of analysis, though Wordfence's disclosure and the CWE-434 pattern make weaponization straightforward.
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets remote, unauthenticated attackers inject arbitrary SQL through the booking workflow, per Patchstack (CVSS 9.3, CWE-89). Because the flaw is reachable without authentication or user interaction (PR:N/UI:N), any WordPress site running the vulnerable Pro plugin is exposed to database compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so this is a high-severity-but-not-yet-weaponized issue.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
SQL injection in the BookingPress Appointment Booking Pro WordPress plugin (versions up to and including 5.7.1) allows unauthenticated attackers to inject SQL through the 'store_service_date' POST parameter of the bpa_assign_staffmember_to_slots() function, enabling extraction of sensitive database contents such as user credentials and PII. The flaw stems from stripslashes_deep() being applied to user input before it is concatenated directly into a LIKE clause without $wpdb->prepare(). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
Unauthenticated arbitrary file upload in the BookingPress Pro WordPress plugin (versions ≤5.6) enables remote code execution by abusing missing file type validation in the bookingpress_validate_submitted_booking_form_func function. Exploitation requires the booking form to include a signature custom field, but otherwise needs no authentication or user interaction. No public exploit identified at time of analysis, though Wordfence's disclosure and the CWE-434 pattern make weaponization straightforward.