Executive brief
BookingPress Appointment Booking Pro is a WordPress plugin used by businesses to manage customer appointments and staff scheduling. A security flaw allows unauthorized individuals to access the website's database without needing a password. This could lead to the theft of sensitive business information, customer data, or administrative credentials.
Technical details
The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient input sanitization in the bpa_assign_staffmember_to_slots() function. Specifically, the 'store_service_date' POST parameter is processed using stripslashes_deep() and then interpolated directly into a SQL LIKE clause without parameterization or the use of $wpdb->prepare(). An attacker can exploit this by sending crafted HTTP POST requests to execute arbitrary SQL commands. This allows for the extraction of sensitive data from the WordPress database, including user hashes and configuration details. The vulnerability affects all versions up to and including 5.7.1.
Affected products
- Repute Infosystems BookingPress Appointment Booking Pro up to and including 5.7.1
Timeline
- 2026-07-01: disclosed: Initial publication of the CVE record
- 2026-07-01: advisory: Wordfence published the vulnerability details