CVE-2026-13395
Deferred Deferred - Pending Action

Unauthenticated SQL Injection in Online Scheduling and Appointment Booking System WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: WPScan

Description
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-13395
EUVD
EUVD-2026-51013

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookly bookly to 27.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated SQL injection flaw in the Bookly WordPress plugin versions before 27.8. It occurs because the plugin does not properly sanitize or cast a user-supplied parameter called 'staff_id' from front-end booking requests before using it in a SQL query. This allows attackers to inject malicious SQL code without authentication.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Bookly plugin version prior to 27.8. You can verify the plugin version via the WordPress admin dashboard under Plugins. Additionally, monitor database queries for unusual activity or unauthorized access attempts.

Impact Analysis

Unauthenticated attackers can exploit this to perform SQL injection attacks. This may allow them to extract sensitive data from the database, such as password hashes, even without logging in. The impact includes potential data breaches and unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or exposure. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Bookly plugin to version 27.8 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Ensure your WordPress installation and all plugins are regularly updated to the latest versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart