External risk intelligence

Bookly SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61949

Bookly is a WordPress appointment booking plugin designed to be accessible to customers on the public internet to schedule appointments. As a web-facing plugin, its functionality is typically exposed directly to the public to facilitate these bookings, making the vulnerable surface reachable from the internet in common deployment scenarios.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an unauthenticated SQL injection vulnerability in the Bookly plugin, a tool used for appointment booking. The issue allows for unauthorized access and manipulation of data within the affected system due to its network-exploitable nature. The primary concern at this stage is to confirm if this specific technology is in use and, if so, to assess the exposure.

Unauthenticated data access in booking software.
Confirms relevance and exposure is the main concern.
Verify use and assess potential data risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a vulnerable Bookly installation. Because the vulnerability is unauthenticated, no login is required. The attacker could target the SQL database, potentially leading to unauthorized access to sensitive information or disruption of services.

No authentication required.
Unauthenticated SQL injection.
Data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

This unauthenticated SQL injection vulnerability in Bookly could allow an attacker to execute arbitrary SQL commands, potentially impacting the confidentiality and integrity of the booking system's data. The vulnerability exists in versions up to and including 27.7.

Booking system data could be affected.
Network access could lead to exposure.
Unauthorized data access or modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

SQL Injection in Bookly affects unauthenticated users and requires immediate attention from teams managing WordPress applications. The first step is to locate all Bookly instances, confirm their reachability and business criticality, and then assign ownership for remediation.

Application owners should prioritize this.
Verify Bookly installation reachability.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Bookly plugin?

Bookly is a WordPress plugin used by businesses to manage online appointment scheduling. It functions as a public-facing interface where customers can browse services, choose time slots, and book appointments directly through a website. Because it acts as a bridge between the public internet and a site's backend database, it is a critical component for managing customer interactions and service availability.

What does SQL injection mean for CVE-2026-61949?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, it means the plugin fails to properly filter inputs before sending them to the database. An attacker can supply malicious database commands instead of expected information, potentially tricking the system into revealing private data or interfering with the database's normal operation.

How is this vulnerability triggered?

The flaw is triggered when an attacker sends a specially crafted network request to the Bookly plugin. Crucially, this does not require a user account or administrative access; the system processes these malicious requests as if they were legitimate traffic. The vulnerability is not triggered by standard usage patterns or by customers simply navigating the booking interface as intended.

Why is this CVE considered relevant for my site?

According to Halo Surface Signal, Bookly is inherently designed to be reachable from the public internet to facilitate bookings. Because this plugin typically resides on web-facing infrastructure to function, it is generally exposed to the network. This makes it easier for an attacker to reach the vulnerable code compared to software that only operates within a private, internal network.

Do I need to take action if I use Bookly?

Yes, you should verify if your WordPress installation is running version 27.7 or earlier, which are impacted by this issue. Your first step is to identify all instances of the plugin within your environment, confirm their reachability, and determine their business criticality. Once these are located, prioritize them for updates or risk-based remediation to protect the confidentiality of your booking system's data.

References

patchstack.com/database/wordpress/plugin/bookly-responsive-appointme…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.