External risk intelligence

BookingPress Appointment Booking Pro SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-68566

The vulnerability affects a booking plugin for WordPress, which is designed to be public-facing to allow customers to schedule appointments via the internet. As an unauthenticated endpoint in a web-based booking system, it is exposed to the public internet by design in normal use.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw exists in a popular WordPress booking plugin, potentially allowing unauthorized access to sensitive data. This vulnerability, if exploited, could impact customer information and the integrity of booking operations. Given its public-facing nature, the primary concern is to confirm if our organization utilizes this specific plugin and assess any potential exposure.

Unauthenticated booking plugin flaw allows data access.
Criticality due to public-facing, unauthenticated nature.
Confirm relevance and exposure to protect data.

Attack Path

How an attacker could exploit the issue

An attacker could target an unauthenticated endpoint in the BookingPress Appointment Booking Pro plugin, potentially through the internet. This exposure allows them to inject malicious SQL code, which could lead to the compromise of sensitive database information and a partial denial of service.

No authentication required for attack.
Inject SQL code into booking features.
Steal data and cause denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the BookingPress Appointment Booking Pro plugin. This could potentially lead to unauthorized access to or manipulation of sensitive booking and customer data stored in the system's database.

Booking and customer data at risk.
Injection via unauthenticated network requests.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in BookingPress Appointment Booking Pro is likely to impact customer-facing web applications. The first step is to identify all instances of this plugin, assess their internet reachability and business criticality, and then confirm the accountable owner for remediation planning.

Application owners should own this issue.
Verify internet exposure and business criticality.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BookingPress Appointment Booking Pro?

BookingPress Appointment Booking Pro is a WordPress plugin used to manage scheduling and reservations. It typically functions as a customer-facing interface where users can browse services, select time slots, and submit personal details to confirm appointments directly on a website.

What does SQL injection mean for CVE-2026-68566?

This vulnerability falls under the CWE-89 weakness class, which happens when software fails to properly sanitize user input before including it in database queries. In the context of CVE-2026-68566, it means an attacker can supply specially crafted data to manipulate the plugin's database commands, potentially allowing them to view restricted information or disrupt system operations.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a malicious request to an unauthenticated endpoint within the plugin. Because no login or user account is required to interact with these specific booking functions, an attacker can attempt to execute the injection without needing pre-existing access to the WordPress site.

Is my site at risk if I use this plugin?

According to Halo Surface Signal, this plugin is designed to be accessible to the public internet so customers can make appointments. Because the vulnerable component is intended to be public-facing for normal operations, any site running version 6.0.2 or earlier should consider itself exposed to potential remote attackers.

What should I do if I have this plugin installed?

First, verify if you are running a version of the plugin affected by this flaw. Next, work with your web development team to identify where the plugin is active and evaluate its business importance. Your priority is to plan for an update or migration to a secure version to protect the sensitive customer data stored in your database.

References

patchstack.com/database/wordpress/plugin/bookingpress-appointment-bo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.