CVE-2026-11823: BookingPress WordPress Plugin SQL Injection

CVE-2026-11823 Overview

CVE-2026-11823 is a SQL Injection vulnerability affecting the BookingPress Appointment Booking Pro plugin for WordPress in versions up to and including 5.7.1. The flaw resides in the bpa_assign_staffmember_to_slots() function, which processes the store_service_date POST parameter without proper sanitization. The plugin passes user-supplied input through stripslashes_deep() and interpolates it directly into a SQL LIKE clause without using $wpdb->prepare() or parameterized queries. Unauthenticated attackers can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can extract sensitive database contents, including user credentials, session tokens, and booking data, over the network without user interaction.

Affected Products

BookingPress Appointment Booking Pro plugin for WordPress versions ≤ 5.7.1
WordPress sites running the vulnerable plugin with the staff-member slot assignment feature enabled
Any hosting environment exposing the affected plugin endpoint to unauthenticated network traffic

Discovery Timeline

2026-07-01 - CVE-2026-11823 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-11823

Vulnerability Analysis

The vulnerability exists in the bpa_assign_staffmember_to_slots() function within class.bookingpress_pro_staff_members.php. The function retrieves the store_service_date value from POST data and processes it through stripslashes_deep(), which removes escape characters that would otherwise mitigate SQL injection. The unsanitized value is then concatenated directly into a SQL LIKE clause. Because WordPress's $wpdb->prepare() parameterization is not used, attackers can inject arbitrary SQL syntax. The injection point occurs within an unauthenticated code path, so no valid session or account is required to reach the vulnerable query. The LIKE clause context permits use of standard injection payloads including UNION SELECT statements to exfiltrate arbitrary table data.

Root Cause

The root cause is the developer's misuse of stripslashes_deep() as a sanitization mechanism. This PHP function is not a security control — it only reverses magic_quotes-style escaping. Combined with direct string interpolation into a SQL statement, the plugin bypasses WordPress's recommended query construction pattern. The fix requires binding the user input through $wpdb->prepare() with the %s placeholder and applying esc_like() before use in a LIKE clause.

Attack Vector

Exploitation requires only network access to the vulnerable WordPress endpoint. An attacker submits a crafted POST request containing malicious SQL syntax in the store_service_date parameter. The injected payload is appended to the plugin's LIKE clause and executed against the WordPress database. Attackers commonly use time-based blind or UNION-based techniques to extract data such as administrator password hashes from wp_users, session tokens from wp_usermeta, and application secrets stored by other plugins. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for the exact vulnerable code location and disclosure details.

Detection Methods for CVE-2026-11823

Indicators of Compromise

POST requests to the BookingPress AJAX endpoint containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA in the store_service_date parameter
Unusual database errors in PHP error logs referencing the bpa_assign_staffmember_to_slots code path
Anomalous outbound queries reading from wp_users, wp_usermeta, or wp_options shortly after unauthenticated POST activity
Elevated request volume from a single source IP targeting the plugin's staff assignment action

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect POST parameters for SQL metacharacters in requests targeting BookingPress endpoints
Enable MySQL general query logging temporarily to identify malformed LIKE clauses containing injected operators
Correlate WordPress admin-ajax.php traffic with database error rates to surface blind injection attempts
Alert on repeated requests from the same client where the store_service_date value contains non-date characters

Monitoring Recommendations

Monitor WordPress access logs for POST requests to the vulnerable plugin action with abnormal parameter lengths
Track database query duration spikes that indicate time-based blind SQL injection attempts using SLEEP() or BENCHMARK()
Watch for creation of new administrator accounts or unexpected changes to the wp_options table following suspicious plugin traffic

How to Mitigate CVE-2026-11823

Immediate Actions Required

Update the BookingPress Appointment Booking Pro plugin to a version later than 5.7.1 as soon as the vendor publishes a patched release
Deactivate the plugin if a patched version is not yet available and the booking functionality is not business-critical
Rotate all WordPress administrator passwords and API keys if evidence of exploitation is found
Audit the wp_users table for unauthorized accounts and review recent booking data for tampering

Patch Information

At the time of publication, review the Wordfence Vulnerability Report for the latest patched version information. Administrators should apply the vendor's fixed release, which is expected to replace direct string interpolation with $wpdb->prepare() and add esc_like() around user-supplied values used in LIKE clauses.

Workarounds

Restrict access to wp-admin/admin-ajax.php at the network layer where feasible, allowing only trusted IP ranges
Deploy WAF signatures that block SQL injection payloads targeting the store_service_date parameter
Disable the BookingPress staff assignment feature until a patched plugin version is installed

bash

# Example ModSecurity rule to block SQLi payloads in store_service_date
SecRule ARGS:store_service_date "@rx (?i)(union[\s\+]+select|sleep\s*\(|information_schema|--\s|/\*)" \
    "id:1026112823,phase:2,deny,status:403,log,\
    msg:'CVE-2026-11823 BookingPress SQLi attempt blocked'"