Is CVE-2026-13454 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13454 being exploited in the wild.

How severe is CVE-2026-13454?

Medium severity, with a CVSS score of 6.5, published 1 July 2026.

Which products and versions are affected?

MotoPress Appointment Booking Up to and including 2.4.5.

Is there a fix for CVE-2026-13454?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13454 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-13454?

Check whether you run MotoPress Appointment Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13454: MotoPress Appointment Booking SQL injection in s parameter

CVE-2026-13454 · Severity: medium · CVSS 6.5 · Published 2026-07-01

The MotoPress Appointment Booking plugin for WordPress, which manages service scheduling and staff appointments, contains a security flaw. An authorized staff member could exploit this vulnerability to gain unauthorized access to the website's database. This could lead to the theft of sensitive business information, customer data, or administrative credentials.

Technologies: MotoPress Appointment Booking. Vendors: MotoPress.

Quick answers

Is CVE-2026-13454 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13454 being exploited in the wild.
How severe is CVE-2026-13454?: Medium severity, with a CVSS score of 6.5, published 1 July 2026.
Which products and versions are affected?: MotoPress Appointment Booking Up to and including 2.4.5.
Is there a fix for CVE-2026-13454?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13454 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13454?: Check whether you run MotoPress Appointment Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the ManageBookingsPage.php component of the MotoPress Appointment Booking plugin due to insufficient escaping of the 's' parameter and a lack of SQL query preparation. Authenticated attackers with the 'mpa_appointment_employee' custom role can inject malicious SQL commands into existing queries. This flaw enables the extraction of sensitive data from the WordPress database. The issue affects all versions up to and including 2.4.5; users should update to a patched version if available.

Affected products

MotoPress Appointment Booking Up to and including 2.4.5

Timeline

2026-07-01: advisory: Vulnerability published by Wordfence/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.