CVE-2026-11823: BookingPress SQL Injection Vulnerability – Unauthenticated Data Disclosure Risk

Technical summary

The vulnerability resides in the bpa_assign_staffmember_to_slots() function, which processes the 'store_service_date' POST parameter. The plugin explicitly applies stripslashes_deep() to user input, which removes backslash escape sequences. This sanitized input is then directly interpolated into a SQL LIKE clause without invoking $wpdb->prepare() or any parameterized query mechanism. SQL Injection flaws of this type (CWE-89) allow attackers to break out of the intended query structure by injecting SQL syntax. Since the plugin accepts unauthenticated requests to this endpoint, an attacker can construct payloads in the store_service_date parameter that append UNION SELECT or other SQL operations to exfiltrate data from the WordPress database, including user tables, custom booking records, and plugin configuration data.

Business impact

Organizations relying on BookingPress to manage appointments and customer bookings face exposure of sensitive business data. Customer information collected during booking (names, email addresses, phone numbers, appointment details) could be accessed by unauthorized parties. If the WordPress installation stores additional sensitive data in custom tables, that too becomes vulnerable. Beyond data theft, successful exploitation could harm customer trust, trigger regulatory compliance issues (GDPR, CCPA), and create liability. For service businesses and healthcare providers using the plugin, the reputational and legal consequences of a data breach are substantial.

Affected systems

BookingPress Appointment Booking Pro plugin for WordPress in versions up to and including 5.7.1 is affected. Any WordPress site running the plugin with this version or earlier on an internet-facing installation is potentially exploitable, regardless of other security measures, since authentication is not required. This includes small business booking sites, service provider portals, and healthcare appointment systems that use the plugin.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no special network access—an attacker simply sends a crafted HTTP POST request with malicious SQL syntax in the store_service_date parameter. The attack surface is the public-facing WordPress site itself. No CVSS exploitability modifier reduces the risk; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector reflects unauthenticated network-based exploitation. While the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, the straightforward nature of SQL Injection attacks means weaponized proof-of-concepts are likely to emerge quickly if not already circulating in underground forums.

Remediation

The immediate remediation is to upgrade BookingPress Appointment Booking Pro to a version released after 5.7.1 that addresses this vulnerability. Check the plugin's official release notes and security advisories to confirm the patched version number. Until an update is available or deployed, disable the plugin or restrict access to the affected booking functionality. If the site cannot be taken offline, implement a Web Application Firewall (WAF) rule to block requests with SQL injection patterns in the store_service_date parameter, though this is a temporary measure only.

Patch guidance

Update BookingPress Appointment Booking Pro to the latest available version—verify the specific patched version number against the official BookingPress release notes and security advisories. After updating, test the plugin's core booking and staff assignment functionality in a staging environment before deploying to production. Clear any cached plugin data to ensure the updated code is loaded. Confirm that the patched version uses parameterized queries (prepared statements via $wpdb->prepare()) for all database operations handling user input.

Detection guidance

Monitor WordPress access logs for POST requests to endpoints associated with the bpa_assign_staffmember_to_slots() function. Look for unusual values in the store_service_date parameter, particularly those containing SQL keywords (UNION, SELECT, OR, AND), comment characters (-- or /*), or quotation marks used to break query syntax. Implement Web Application Firewall rules to flag or block requests matching common SQL injection patterns. Consider using WordPress security plugins that monitor for SQL injection attempts. Review database query logs for unexpected queries or data access patterns following the publication date of this vulnerability. If you cannot immediately update, enable verbose logging on the WordPress installation and monitor for failed or unusual database operations.

Why prioritize this

This vulnerability merits immediate attention due to its combination of unauthenticated access, high impact (confidentiality of sensitive customer and business data), and straightforward exploitation. The CVSS 7.5 HIGH severity reflects the real-world threat: SQL Injection on public-facing code is a well-understood attack vector with a low barrier to entry for attackers. Organizations using BookingPress should prioritize patching or mitigation within days, not weeks, as exploitation is likely to be attempted once word spreads beyond initial disclosure.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) is calculated as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Attack Vector (AV:N) reflects network accessibility—no special access needed. Attack Complexity (AC:L) indicates the attack requires no special conditions or timing. Privilege Required (PR:N) means authentication is not necessary. User Interaction (UI:N) shows the victim need not click a link or take action. Scope Unchanged (S:U) indicates the impact is limited to the affected component. Confidentiality Impact (C:H) is the primary threat—unauthorized data disclosure. Integrity (I:N) and Availability (A:N) are not impacted by this SQL Injection variant, which reads data rather than modifying or disrupting services.

Frequently asked questions