BookingPress Appointment Booking Pro vulnerabilities
3 known CVE vulnerabilities in BookingPress Appointment Booking Pro, translated and rated.
- CVE-2026-68566Critical
Unauthenticated SQL Injection vulnerability in the BookingPress Appointment Booking Pro plugin. Affects versions up to 6.0.2.
- CVE-2026-9830High
The bookingpress-appointment-booking-pro WordPress plugin before version 5.7.3 incorrectly implements its REST permission callback. This allows unauthenticated attackers to access API routes, read customer booking data, and modify other users' bookings.
- CVE-2026-11823High
The BookingPress Appointment Booking Pro plugin for WordPress up to version 5.7.1 is vulnerable to SQL Injection via the 'store_service_date' parameter in the bpa_assign_staffmember_to_slots() function. This is due to the use of stripslashes_deep() on POST data without using $wpdb->prepare(), allowing unauthenticated attackers to append additional SQL queries.