Description

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-20T12:16:36.313Z",
  "pubdate": "2026-08-20T12:16:36.313Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in the BookingPress Appointment Booking Pro plugin affecting versions 6.0.2 and below. This security flaw enables remote attackers to manipulate database queries without requiring prior authentication or user privileges. Successful exploitation of this vulnerability can lead to unauthorized access to sensitive application data, including user credentials, personal identifiable information, and potentially complete database compromise depending on the database user privileges. The flaw introduces severe risk implications for websites utilizing the affected plugin, as it exposes the underlying database management system to malicious input manipulation. Attackers can leverage this vulnerability by injecting arbitrary SQL commands into vulnerable input parameters handled by the booking system, bypassing standard security controls and input sanitization mechanisms. Exploitation requires network access to the vulnerable WordPress installation hosting the BookingPress Appointment Booking Pro plugin, with no user interaction or specialized privileges required to initiate the attack vector.",
  "technicalDetails": "The vulnerability resides within the input handling mechanisms of the BookingPress Appointment Booking Pro plugin for versions <= 6.0.2, where user-supplied parameters are inadequately sanitized, parameterized, or escaped before being concatenated into database queries executed via the underlying database abstraction layer. The root cause stems from improper neutralization of special elements used in SQL commands, allowing malicious input to alter the syntax and logic of the original query structure. Attackers exploit this flaw by submitting crafted HTTP requests containing malicious SQL payloads targeted at vulnerable endpoints exposed by the plugin. The attack flow initiates when an unauthenticated HTTP request is sent to the target server containing the malicious payload within an unsanitized parameter. The vulnerable component processes the request and improperly incorporates the tainted input directly into a database query. Consequently, the database management system executes the modified query, allowing the attacker to perform error-based, boolean-based, or time-based blind SQL injection techniques, or union-based data retrieval. Network exposure is broad, as the vulnerable endpoints are accessible over standard web protocols (HTTP/HTTPS) to any remote user without authentication or privilege requirements. Post-exploitation impact includes unauthorized data extraction, modification, or deletion of database contents, potential administrative privilege escalation within the application context, and in certain deployment scenarios, operating system command execution or remote code execution via database features."
}