Junglewise Threat Intelligence

CVE-2026-14516: ladela Bookly SQL injection in staff_ids parameter

CVE-2026-14516 · Severity: high · CVSS 7.5 · Published 2026-07-28

Executive brief

The Bookly plugin for WordPress, which manages online appointment scheduling, contains a security flaw that allows unauthorized individuals to access sensitive database information. By sending specially crafted requests, an attacker can trick the system into revealing data it shouldn't, potentially compromising customer or business records. This issue affects all versions of the plugin up to 27.5 and can be exploited remotely without needing a password.

Technical details

The Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in versions up to and including 27.5. This is caused by insufficient escaping of user-supplied input and a lack of SQL query preparation in the 'Finder.php' and 'ChainItem.php' components. Exploitation requires a two-step chain: first, an attacker calls the unauthenticated 'bookly_get_form_id' action to seed a session with a malicious 'staff_ids' value; second, they trigger 'bookly_render_time' to execute the tainted query. Because CSRF and nonce protections are absent on these endpoints, the attack can also be initiated cross-site. Successful exploitation allows an unauthenticated attacker to extract sensitive data from the WordPress database.

Affected products

  • ladela Online Scheduling and Appointment Booking System – Bookly up to, and including, 27.5

Timeline

  • 2026-07-28: disclosed: Vulnerability disclosed by Wordfence and published in NVD.

References