External risk intelligence

JetAppointment Unauthenticated SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73365

The vulnerability affects a WordPress appointment booking plugin. Such plugins are designed to be internet-facing to allow site visitors and customers to interact with booking interfaces, making them commonly reachable via public web traffic.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular booking plugin that allows for unauthenticated SQL injection. This means an attacker could potentially access or manipulate sensitive data without needing any credentials. While the primary concern is confirming if this plugin is in use and exposed, such issues can impact data integrity and service availability if exploited.

Unauthenticated data access risk in booking software.
Confirms exposure and relevance of booking systems.
Focus on data integrity and system availability.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted SQL queries over the network to the vulnerable plugin. This could lead to unauthorized access to sensitive data, potentially impacting database integrity and system availability.

No authentication required.
SQL injection via crafted queries.
Unauthorized data access and system impact.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in the JetAppointments plugin could allow an unauthenticated attacker to access and potentially alter sensitive database information when the plugin is active and exposed to the internet. The attacker could achieve this by manipulating input fields to execute arbitrary SQL commands, impacting the integrity and confidentiality of stored data.

Sensitive database information.
Via unauthenticated network requests.
Data exposure and potential corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects unauthenticated SQL injection in JetAppointment plugins. The first step is to identify all instances of this plugin, determine their reachability and business criticality, and locate the accountable owner for remediation planning.

Application owners or platform teams.
Verify plugin reachability and business impact.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the JetAppointment plugin used for?

JetAppointment is a WordPress plugin designed to manage scheduling and booking workflows. It enables site visitors and customers to interact with booking calendars, appointment forms, and service availability directly through a website's user interface.

How does CVE-2026-73365 function as a vulnerability?

This issue is an SQL injection, categorized as CWE-89. It happens when software improperly filters user input before using it in database queries. In this case, it allows an unauthenticated user to inject their own SQL commands, which the database then executes, potentially revealing or changing sensitive information stored by the plugin.

Do I need to be logged in to trigger this SQL injection?

No. This vulnerability does not require authentication. An attacker can attempt to trigger it simply by sending specially crafted web requests to the plugin over a network. Merely navigating the site normally or using legitimate booking forms does not trigger the flaw; it requires the intentional submission of malicious query strings.

Why should I care about this CVE if my site uses JetAppointment?

Halo Surface Signal notes that since JetAppointment is a booking plugin, it is inherently designed to be internet-facing to support customer interactions. This makes your database more likely to be reachable by external web traffic, increasing the relevance of this vulnerability if you have public-facing appointment forms.

How should I respond if I run JetAppointment?

Start by identifying every WordPress instance where JetAppointment is installed. Determine which of these sites are accessible from the internet and identify the business owners responsible for those platforms. Coordinate with them to assess the risk and plan the necessary updates or security measures to protect your database.

References

patchstack.com/database/wordpress/plugin/jet-appointments-booking/vu…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.