Executive brief
The MotoPress Appointment Booking plugin for WordPress, which manages service scheduling and staff appointments, contains a security flaw. An authorized staff member could exploit this vulnerability to gain unauthorized access to the website's database. This could lead to the theft of sensitive business information, customer data, or administrative credentials.
Technical details
A SQL injection vulnerability exists in the ManageBookingsPage.php component of the MotoPress Appointment Booking plugin due to insufficient escaping of the 's' parameter and a lack of SQL query preparation. Authenticated attackers with the 'mpa_appointment_employee' custom role can inject malicious SQL commands into existing queries. This flaw enables the extraction of sensitive data from the WordPress database. The issue affects all versions up to and including 2.4.5; users should update to a patched version if available.
Affected products
- MotoPress Appointment Booking Up to and including 2.4.5
Timeline
- 2026-07-01: advisory: Vulnerability published by Wordfence/NVD
References
- https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/admin-pages/manage/ManageBookingsPage.php
- https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/admin-pages/manage/ManageBookingsPage.php
- https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.5/includes/admin-pages/manage/ManageBookingsPage.php
- https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.5/includes/admin-pages/manage/ManageBookingsPage.php
- https://plugins.trac.wordpress.org/changeset/3591693/motopress-appointment-lite/trunk/includes/admin-pages/manage/ManageBookingsPage.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/64e4d51a-7b65-4fba-9742-bc7d23f46f8d?source=cve