Online Scheduling And Appointment Booking System
Monthly
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.