CVE-2026-14516
Received Received - Intake

Time-Based SQL Injection in Bookly WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a two-request chain: an attacker first calls the unauthenticated bookly_get_form_id action to seed a booking session carrying malicious staff_ids values, then triggers bookly_render_time to cause the tainted array to reach the vulnerable query; CSRF/nonce validation is absent on both endpoints, meaning this chain can be initiated cross-site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-14516
EUVD
EUVD-2026-49720

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookly plugin to 27.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a time-based SQL Injection in the Online Scheduling and Appointment Booking System – Bookly plugin for WordPress. It exists in versions up to 27.5 due to insufficient input sanitization and lack of proper SQL query preparation. Attackers can exploit it by sending malicious staff_ids parameters to extract sensitive data from the database. Exploitation requires two unauthenticated requests: one to seed a booking session with malicious data and another to trigger the vulnerable query. No CSRF protection or nonce validation is present.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Bookly plugin versions up to 27.5 for unauthenticated requests to bookly_get_form_id and bookly_render_time endpoints with malicious staff_ids parameters. Check server logs for suspicious SQL query patterns or unusual database access.

Impact Analysis

This vulnerability allows unauthenticated attackers to extract sensitive information from the WordPress database, including user credentials, personal data, and other confidential details. If exploited, it could lead to data breaches, unauthorized access to user accounts, and potential compromise of the entire WordPress site. Attackers may also chain this with other exploits for further damage.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access and potential data breaches. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful exploit may result in regulatory fines, legal liabilities, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Update the Online Scheduling and Appointment Booking System – Bookly plugin for WordPress to version 27.5 or later to address the SQL injection vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14516. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart