CVE-2026-11823
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The BookingPress Appointment Booking Pro plugin for WordPress up to version 5.7.1 is vulnerable to SQL Injection via the 'store_service_date' parameter in the bpa_assign_staffmember_to_slots() function. This is due to the use of stripslashes_deep() on POST data without using $wpdb->prepare(), allowing unauthenticated attackers to append additional SQL queries.
Risk Assessment
An unauthenticated attacker can exploit this vulnerability to extract sensitive information from the database, such as user passwords, customer data, or API keys, leading to a breach of confidentiality and system integrity.
Recommendation
Immediately update the BookingPress Appointment Booking Pro plugin to the latest available version that fixes this vulnerability, and use parameterized SQL queries instead of directly interpolating user-supplied data.
Other vulnerabilities in BookingPress Appointment Booking Pro
See all- CVE-2026-68566Critical
Unauthenticated SQL Injection vulnerability in the BookingPress Appointment Booking Pro plugin. Affects versions up to 6.0.2.
- CVE-2026-9830High
The bookingpress-appointment-booking-pro WordPress plugin before version 5.7.3 incorrectly implements its REST permission callback. This allows unauthenticated attackers to access API routes, read customer booking data, and modify other users' bookings.
Original NVD description (English source)
The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.