Is CVE-2026-48882 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48882 being exploited in the wild.

How severe is CVE-2026-48882?

High severity, with a CVSS score of 8.5, published 15 June 2026.

Which products and versions are affected?

CodePeople WP Time Slots Booking Form <= 1.2.50.

Is there a fix for CVE-2026-48882?

A patch was published on 2026-06-02: Version 1.2.51 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48882 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-48882?

Check whether you run CodePeople WP Time Slots Booking Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48882: CodePeople WP Time Slots Booking Form SQL injection

Q: Is there a fix for CVE-2026-48882?

A patch was published on 2026-06-02: Version 1.2.51 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48882 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-48882?

Check whether you run CodePeople WP Time Slots Booking Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48882 · Severity: high · CVSS 8.5 · Published 2026-06-15

The WP Time Slots Booking Form plugin for WordPress, which allows websites to manage appointment scheduling, contains a security flaw that could allow logged-in users to access sensitive database information. An attacker with a basic 'Subscriber' account could exploit this to steal customer data or other confidential information stored in the site's database. This could lead to data breaches and significant reputational damage for businesses relying on the booking system.

Vendors: CodePeople.

Quick answers

Is CVE-2026-48882 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48882 being exploited in the wild.
How severe is CVE-2026-48882?: High severity, with a CVSS score of 8.5, published 15 June 2026.
Which products and versions are affected?: CodePeople WP Time Slots Booking Form <= 1.2.50.
Is there a fix for CVE-2026-48882?: A patch was published on 2026-06-02: Version 1.2.51 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48882 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-48882?: Check whether you run CodePeople WP Time Slots Booking Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the WP Time Slots Booking Form plugin for WordPress due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw is present in versions up to and including 1.2.50. An authenticated attacker with Subscriber-level privileges can send specially crafted network requests to execute arbitrary SQL queries against the backend database. This can result in the unauthorized extraction of sensitive information, including user credentials and site configuration. The issue is addressed in version 1.2.51.

Affected products

CodePeople WP Time Slots Booking Form <= 1.2.50

Timeline

2026-05-16: other: Reported by researcher xwii
2026-06-02: advisory: Patchstack advisory published
2026-06-15: disclosed: NVD publication date
2026-06-02: patched: Version 1.2.51 released

References

https://patchstack.com/database/wordpress/plugin/wp-time-slots-booking-form/vulnerability/wordpress-wp-time-slots-booking-form-plugin-1-2-50-sql-injection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.