What the vulnerability does
01Description
The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Explanation of Vulnerability in Simple Terms
02Summary
BookingPress Appointment Booking Pro versions up to 5.7.1 contain a SQL injection vulnerability in an unauthenticated endpoint. An attacker can query the site's database directly to extract sensitive information such as user credentials, appointment details, and other stored data. No user interaction is required; the vulnerability is exploitable over the network.
What an attacker can do
03Attacker Capabilities
Extract sensitive data from the site database, including user credentials and appointment information.
Potential impact on your site
04Site Impact
Visitor and customer data, including passwords and booking details, can be stolen without warning or detection.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 1, 2026
CVE published
July 1, 2026
Record updated
