Security Alert Summary
The BookingPress Appointment Booking Pro plugin for WordPress contains a SQL injection vulnerability in the handling of the store_service_date POST parameter within the bpa_assign_staffmember_to_slots() function. The plugin applies stripslashes_deep() to user-supplied data and then interpolates it directly into a SQL LIKE clause without using $wpdb->prepare() or other parameterization, allowing unauthenticated attackers to append additional SQL and potentially extract sensitive database information.
CVE Details
- CVE ID: CVE-2026-11823
- Affected component: BookingPress Appointment Booking Pro plugin for WordPress
- Affected versions: All versions up to and including 5.7.1
- Published: July 1, 2026 at 7:16:22 AM UTC
- Last modified: July 1, 2026 at 1:56:17 PM UTC
- CVSS v3.1: Base Score 7.5 – HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication / Privileges / User interaction: Authentication not required; Privileges Required: NONE; User Interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
The vulnerability arises in the bpa_assign_staffmember_to_slots() function when it processes the store_service_date POST parameter. The code calls stripslashes_deep() on the incoming data and then places that value directly into a SQL LIKE clause without any use of $wpdb->prepare() or other parameter binding. Because the input is interpolated verbatim, an attacker can craft input that appends additional SQL to the query.
In practice this lack of parameterization allows unauthenticated attackers to perform SQL injection against the affected query paths and extract sensitive information from the database. The description specifically identifies the use of stripslashes_deep() and the absence of $wpdb->prepare() or equivalent parameterization as the root cause.
How This Could Impact Your Website
On a site using this plugin, an unauthenticated attacker exploiting the SQL injection could retrieve data stored in the database that the vulnerable query can access. In a small team scenario this might expose internal user email addresses or other stored records that are accessible through the affected query. For example, a site owner, an internal staff member managing bookings, and an external contractor with limited access could find that contact information or booking records are retrievable by an attacker targeting the vulnerable endpoint.
Risks from exposed email addresses include an increased likelihood of targeted phishing or social engineering against staff or contractors. The vulnerability does not by itself indicate arbitrary code execution or full site takeover, but it can disclose sensitive data that supports further attacks.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege roles that still have access to booking interfaces.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and database access logs for unusual queries or data exports.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
