Is CVE-2026-11823 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11823 being exploited in the wild.

How severe is CVE-2026-11823?

High severity, with a CVSS score of 7.5, published 1 July 2026.

Which products and versions are affected?

Repute InfoSystems BookingPress Appointment Booking Pro up to and including 5.7.1.

Is there a fix for CVE-2026-11823?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11823 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11823?

Check whether you run Repute InfoSystems BookingPress Appointment Booking Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11823: Repute Infosystems BookingPress Pro SQL injection in store_service_date

CVE-2026-11823 · Severity: high · CVSS 7.5 · Published 2026-07-01

BookingPress Appointment Booking Pro is a WordPress plugin used by businesses to manage customer appointments and staff scheduling. A security flaw allows unauthorized individuals to access the website's database without needing a password. This could lead to the theft of sensitive business information, customer data, or administrative credentials.

Vendors: Repute InfoSystems.

Quick answers

Is CVE-2026-11823 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11823 being exploited in the wild.
How severe is CVE-2026-11823?: High severity, with a CVSS score of 7.5, published 1 July 2026.
Which products and versions are affected?: Repute InfoSystems BookingPress Appointment Booking Pro up to and including 5.7.1.
Is there a fix for CVE-2026-11823?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11823 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11823?: Check whether you run Repute InfoSystems BookingPress Appointment Booking Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient input sanitization in the bpa_assign_staffmember_to_slots() function. Specifically, the 'store_service_date' POST parameter is processed using stripslashes_deep() and then interpolated directly into a SQL LIKE clause without parameterization or the use of $wpdb->prepare(). An attacker can exploit this by sending crafted HTTP POST requests to execute arbitrary SQL commands. This allows for the extraction of sensitive data from the WordPress database, including user hashes and configuration details. The vulnerability affects all versions up to and including 5.7.1.

Affected products

Repute Infosystems BookingPress Appointment Booking Pro up to and including 5.7.1

Timeline

2026-07-01: disclosed: Initial publication of the CVE record
2026-07-01: advisory: Wordfence published the vulnerability details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.