Skip to content
Sign in
7.5 High

CVE-2026-11823 The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the…

Description

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected products and versions

Product Affected versions Fixed in
BookingPress Appointment Booking Pro 5.7 earliest → 5.7.1 No fix stated

Other CVEs of BookingPress Appointment Booking Pro

The 3 CVEs of BookingPress Appointment Booking Pro →
CVE-2026-68566 Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions 9.3 Critical CVE-2026-6960 The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… 9.8 Critical
Track this CVE