CVE-2026-48882: WP Time Slots Booking Form SQL Injection Vulnerability – CVSS 8.5

Technical summary

CVE-2026-48882 is a subscriber-level SQL injection vulnerability in the WP Time Slots Booking Form plugin. The vulnerability exists due to insufficient input validation and parameterization in database queries. An attacker with a valid WordPress subscriber account can craft malicious input through the plugin's interface to inject SQL commands. The attack requires authentication (PR:L) but no user interaction (UI:N), and the scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component itself. The CVSS 3.1 score of 8.5 reflects high confidentiality impact with limited availability impact.

Business impact

Organizations using WP Time Slots Booking Form may face data exfiltration risks, including exposure of customer contact information, booking details, payment data (if stored in the database), and WordPress user account details. The confidentiality impact is severe because attackers can read database contents without leaving obvious audit trails. While integrity and availability impacts are lower, unauthorized data access alone can trigger compliance violations (GDPR, HIPAA, PCI-DSS depending on data stored) and reputational harm. The ability for any subscriber-level account—including potentially compromised or malicious employees—to exploit this increases risk in multi-user WordPress installations.

Affected systems

WP Time Slots Booking Form plugin in all versions up to and including 1.2.50 is affected. This vulnerability impacts WordPress installations where this plugin is active and where subscriber-level accounts exist. Risk is highest in instances managing sensitive booking data (medical appointments, legal consultations, financial services) or those integrated with external systems that rely on database confidentiality.

Exploitability

Exploitability is moderate to high. The attack requires valid subscriber credentials, which is a common access level in multi-user WordPress sites and may be obtained through credential compromise, insider threats, or social engineering. The attack surface is the plugin's input handling—any form field or API parameter processed by the plugin could serve as an injection point. No public exploit code availability has been reported, but SQL injection is a well-understood attack class with readily available tools and payloads.

Remediation

Update WP Time Slots Booking Form to a patched version released after 1.2.50. Verify the specific patched version number against the official plugin repository or vendor advisory. As an interim measure, restrict subscriber-level account creation to trusted users, review existing subscriber accounts for suspicious activity, and consider disabling the plugin until patching is feasible.

Patch guidance

Check the WordPress Plugin Directory or the vendor's official website for the latest patched version of WP Time Slots Booking Form. Update through the WordPress admin dashboard's plugin management interface once a patch is available. Verify via changelog that the update addresses CVE-2026-48882. Test the update in a staging environment before deploying to production to ensure compatibility with other plugins and themes. If an automatic update is available, enable it only after confirming vendor recommendation.

Detection guidance

Monitor database logs and WordPress audit logs for unusual SQL patterns originating from authenticated sessions with subscriber privileges. Look for queries containing SQL keywords (UNION, SELECT, INSERT, DROP) in request parameters. Use WordPress security plugins with SQL injection detection capabilities. Check server access logs for POST/GET requests to plugin-related endpoints with suspicious special characters or encoding. If available, enable your WAF or ModSecurity rules for SQL injection signatures. Review subscriber account login patterns for anomalies.

Why prioritize this

Despite not appearing in CISA's KEV catalog, this vulnerability should be prioritized because: (1) it requires only subscriber-level access, common in WordPress environments; (2) confidentiality impact is high, enabling data exfiltration; (3) the plugin's booking use case often means sensitive personal information is at risk; (4) SQL injection is a reliable, well-understood attack vector; (5) the plugin may have a broad user base given its public availability. Organizations should treat this with urgency equal to CVSS 8.5, not defer it pending KEV inclusion.

Risk score, explained

The CVSS 3.1 score of 8.5 (HIGH) reflects: (1) network accessibility (AV:N) allows remote exploitation; (2) low attack complexity (AC:L) means no special conditions are required; (3) low privilege requirement (PR:L) means subscriber-level access is sufficient; (4) no user interaction needed (UI:N); (5) changed scope (S:C) indicates the vulnerability impacts confidentiality of systems or data beyond the vulnerable component; (6) high confidentiality impact (C:H) from unrestricted data exfiltration; (7) low availability impact (A:L) from potential resource exhaustion. Integrity is unaffected (I:N) in this variant.

Frequently asked questions