CVE-2026-15289: SQL Injection in Booking Calendar WordPress Plugin

Technical summary

CVE-2026-15289 is a time-based SQL injection vulnerability in the Booking calendar and Appointment Booking System WordPress plugin affecting all versions through 3.2.17. The flaw stems from insufficient escaping of the 'wpdevart_id' parameter combined with improper SQL query preparation (CWE-89). An unauthenticated attacker can craft requests that append arbitrary SQL queries to existing database statements. The attack surface is limited to installations running the Pro version with the 'Delete previous dates' option enabled, which alters how the plugin processes the vulnerable parameter. Time-based injection techniques allow attackers to infer database contents through observable response delays.

Business impact

For WordPress site operators, this vulnerability poses a confidentiality risk that could expose customer data, booking information, authentication credentials, or other sensitive database records. The plugin's appointment booking context suggests typical installations store personal information like names, email addresses, phone numbers, and booking details. While the vulnerability does not permit data modification or availability attacks according to the CVSS vector, unauthorized data disclosure can lead to privacy violations, regulatory non-compliance, and reputational harm. The attack requires no authentication, meaning any internet-facing installation remains at risk if the specific plugin configuration conditions are met.

Affected systems

The vulnerability affects the Booking calendar and Appointment Booking System WordPress plugin in all versions up to and including 3.2.17. Exploitation is contingent on two conditions: (1) the Pro version must be installed and activated, and (2) the 'Delete previous dates' option must be checked in plugin settings. WordPress installations with only the free version, or those with the Pro version but without the specific setting enabled, are not vulnerable. Site administrators should verify their plugin version and configuration to determine exposure.

Exploitability

The attack is feasible for a remote, unauthenticated threat actor with network access to the WordPress site. However, exploitation has specific prerequisites that reduce the overall attack surface: the Pro version must be active and a particular feature must be enabled. No user interaction is required. The CVSS score of 5.9 (Medium severity) reflects the combination of high impact (complete information disclosure) tempered by high attack complexity due to these environmental constraints. Time-based SQL injection typically requires iterative requests and inference logic but remains practical for extracting database schemas and sensitive records.

Remediation

Site administrators should update the Booking calendar and Appointment Booking System plugin to a patched version that addresses the insufficient escaping and improper SQL query preparation. Verify the availability of a corrected version from the plugin vendor and apply the update immediately. As an interim mitigation pending patches, administrators can disable the 'Delete previous dates' option or deactivate the Pro version features if operationally feasible, though this does not eliminate the underlying vulnerability. Additionally, restrict direct access to the affected parameter through web application firewall (WAF) rules if possible, and monitor database query logs for suspicious activity.

Patch guidance

Check the official WordPress plugin repository and the plugin vendor's security advisories for a patched version addressing CVE-2026-15289. Update to the latest available version once confirmed to remediate the SQL injection flaw. Test the patch in a staging environment to ensure compatibility with your WordPress setup, themes, and other plugins before production deployment. After patching, verify that the 'Delete previous dates' option and other critical settings remain intact. If the vendor has not yet released a patch, contact them for an estimated timeline and consider the interim mitigations noted above.

Detection guidance

Monitor web server and WordPress logs for suspicious requests to endpoints handling appointment booking functionality, particularly those containing SQL metacharacters or encoded sequences in the 'wpdevart_id' parameter. Watch for patterns consistent with time-based SQL injection: repeated requests with time-based delays, requests with UNION, SELECT, or SLEEP keywords, or requests with OR/AND boolean logic. Database activity monitoring can reveal unusual query patterns or access to system tables (information_schema, mysql). WordPress security plugins and WAF solutions may offer detection rules for SQL injection attempts. Correlate findings across logs to identify reconnaissance or data exfiltration attempts.

Why prioritize this

Although the CVSS score is Medium (5.9), this vulnerability merits prompt attention because it enables complete unauthorized access to sensitive database records without requiring authentication, user interaction, or privileges. The Booking plugin context indicates likely exposure of personally identifiable information and customer booking data, creating both privacy and compliance risks. The relatively low attack complexity barrier—once the Pro version and specific setting are present—means many real-world deployments could be vulnerable. Unauthenticated, remotely exploitable SQL injection is a perennial high-priority issue for active defense.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects a confidentiality impact of HIGH (the attacker can extract all data from the database), combined with no integrity or availability impact. The attack vector is NETWORK, requiring only internet access. Privileges required (PR) is NONE, and user interaction (UI) is NONE, both favorable to the attacker. Attack complexity (AC) is HIGH, accounting for the prerequisite that the Pro version must be installed with a specific setting enabled; this environmental factor raises the complexity but does not eliminate the vulnerability. The result is a Medium-severity rating that appropriately reflects serious data exposure risk balanced against the specific plugin configuration requirements.

Frequently asked questions