CVE-2026-68566
CriticalCVSS 9.3Summary
Unauthenticated SQL Injection vulnerability in the BookingPress Appointment Booking Pro plugin. Affects versions up to 6.0.2.
Risk Assessment
An unauthenticated attacker can inject SQL queries, potentially leading to data leakage, database modification, or admin account takeover.
Recommendation
Immediately update the BookingPress Appointment Booking Pro plugin to a version that fixes this vulnerability.
Other vulnerabilities in BookingPress Appointment Booking Pro
See all- CVE-2026-9830High
The bookingpress-appointment-booking-pro WordPress plugin before version 5.7.3 incorrectly implements its REST permission callback. This allows unauthenticated attackers to access API routes, read customer booking data, and modify other users' bookings.
- CVE-2026-11823High
The BookingPress Appointment Booking Pro plugin for WordPress up to version 5.7.1 is vulnerable to SQL Injection via the 'store_service_date' parameter in the bpa_assign_staffmember_to_slots() function. This is due to the use of stripslashes_deep() on POST data without using $wpdb->prepare(), allowing unauthenticated attackers to append additional SQL queries.
Original NVD description (English source)
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS