# CVE-2026-32557: WooCommerce Appointments SQL injection

Source: https://junglewise.ai/threats/cve-2026-32557-unauthenticated-sql-injection-in-woocommerce-appointments-5-3-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-32557 · Severity: critical · CVSS 9.3 · Published 2026-10-06

WooCommerce Appointments is a WordPress plugin that allows online booking and appointment management for e-commerce stores. An unauthenticated SQL injection vulnerability in versions 5.3.2 and earlier permits attackers to read, modify, or delete the entire database without logging in, potentially exposing customer records, payment data, and account credentials.

Vendors: [WooCommerce](https://junglewise.ai/threats/vendors/woocommerce).

## Quick answers

**Is CVE-2026-32557 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32557 being exploited in the wild.

**How severe is CVE-2026-32557?** Critical severity, with a CVSS score of 9.3, published 6 October 2026.

**Which products and versions are affected?** WooCommerce Appointments 5.3.2 and earlier.

**Is there a fix for CVE-2026-32557?** No fixed version is recorded yet. Apply a mitigation rule through Patchstack or similar WordPress security solutions to block attack attempts until an official patch is available. As immediate action, update the plugin when a patch is released or contact your hosting provider or web developer for assistance. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-32557 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32557?** Check whether you run WooCommerce Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Apply a mitigation rule through Patchstack or similar WordPress security solutions to block attack attempts until an official patch is available. As immediate action, update the plugin when a patch is released or contact your hosting provider or web developer for assistance.

## Technical details

An unauthenticated SQL injection flaw in WooCommerce Appointments allows attackers to execute arbitrary SQL queries against the database via a network request, requiring no authentication or user interaction. Successful exploitation enables complete database compromise including customer data, credentials, and order information. No official patch is currently available as of the advisory publication date.

## Affected products

- WooCommerce Appointments 5.3.2 and earlier

## Timeline

- 2026-10-06: disclosed: Vulnerability published by Patchstack
- 2026-04-14: other: Initially reported to vendor

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woocommerce-appointments/vulnerability/wordpress-woocommerce-appointments-plugin-5-3-2-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woocommerce-appointments/vulnerability/wordpress-woocommerce-appointments-plugin-5-3-2-sql-injection-vulnerability?_s_id=cve)