CVE-2025-8781: Bookster WordPress Plugin SQLi Vulnerability

CVE-2025-8781 Overview

The Bookster – WordPress Appointment Booking Plugin for WordPress contains a SQL Injection vulnerability in the raw parameter affecting all versions up to and including 2.1.1. This security flaw stems from insufficient escaping on user-supplied input and inadequate preparation of SQL queries within the plugin's query builder component.

Critical Impact

Authenticated attackers with Administrator-level access can exploit this SQL Injection vulnerability to append malicious SQL queries into existing queries, enabling extraction of sensitive information from the WordPress database.

Affected Products

• Bookster – WordPress Appointment Booking Plugin versions up to and including 2.1.1
• WordPress installations utilizing affected Bookster plugin versions

Discovery Timeline

• 2026-02-18 - CVE CVE-2025-8781 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-8781

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a critical web application security flaw that allows attackers to interfere with database queries. The vulnerable code resides in the QueryBuilder.php file within the Bookster plugin's database models component, specifically at line 133.

The plugin fails to properly sanitize user-supplied input passed through the raw parameter before incorporating it into SQL queries. Without adequate escaping or parameterized queries, malicious input can break out of the intended query structure and execute arbitrary SQL commands against the WordPress database.

While this vulnerability requires Administrator-level authentication to exploit, it still poses significant risk as it could be leveraged by compromised admin accounts or malicious insiders to exfiltrate sensitive data including user credentials, customer information, and appointment booking details.

Root Cause

The root cause is the lack of sufficient input escaping and absence of prepared statements in the QueryBuilder component. The raw parameter accepts user-supplied input that is directly incorporated into SQL queries without proper sanitization, violating secure coding practices for database interactions.

Attack Vector

The vulnerability is exploitable over the network by authenticated administrators. An attacker with valid administrator credentials can craft malicious input containing SQL injection payloads via the raw parameter. These payloads are then executed against the database, allowing the attacker to extract sensitive information through techniques such as UNION-based injection, blind SQL injection, or error-based injection depending on database configuration.

The attack requires no user interaction and targets the confidentiality of database contents. For detailed technical analysis of the vulnerability, refer to the Wordfence Vulnerability Analysis and the WordPress QueryBuilder Code Review.

Detection Methods for CVE-2025-8781

Indicators of Compromise

• Unusual database queries or error messages in WordPress debug logs containing SQL syntax anomalies
• Unexpected data extraction patterns or large database read operations from administrator sessions
• Suspicious administrator activity accessing Bookster plugin endpoints with malformed parameters
• Database audit logs showing queries with injection patterns such as UNION SELECT or stacked queries

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection attack signatures targeting Bookster plugin endpoints
• Implement database activity monitoring to detect anomalous query patterns from the WordPress application
• Review WordPress admin activity logs for suspicious parameter values in Bookster-related requests
• Deploy endpoint detection solutions capable of identifying SQL injection exploitation attempts

Monitoring Recommendations

• Enable detailed logging for the Bookster plugin and WordPress database queries
• Configure alerting for SQL error messages that may indicate injection attempts
• Monitor administrator account activity for signs of compromise or abuse
• Implement real-time database query analysis to detect data exfiltration attempts

How to Mitigate CVE-2025-8781

Immediate Actions Required

• Update the Bookster – WordPress Appointment Booking Plugin to a version newer than 2.1.1 that addresses this vulnerability
• Audit administrator accounts for any signs of compromise or unauthorized access
• Review database logs for evidence of SQL injection exploitation
• Consider temporarily disabling the Bookster plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in WordPress Changeset #3434484. WordPress site administrators should update the Bookster plugin through the WordPress dashboard or by manually applying the patched version from the WordPress plugin repository. The fix implements proper input sanitization and prepared statements for the raw parameter in the QueryBuilder component.

Workarounds

• Restrict administrator access to trusted users only until the patch is applied
• Implement a Web Application Firewall (WAF) with SQL injection detection rules to block malicious requests
• Enable WordPress security plugins with SQL injection protection capabilities
• Consider database-level restrictions on the WordPress database user to limit potential damage from exploitation

# Configuration example
# Add to wp-config.php to enable database query logging for monitoring
define('SAVEQUERIES', true);

# Restrict plugin access via .htaccess (place in wp-content/plugins/bookster/)
<Files "*.php">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
</Files>