CVE-2026-13395: WordPress Booking Plugin SQLi Vulnerability

CVE-2026-13395 Overview

CVE-2026-13395 is an unauthenticated SQL injection vulnerability in the Online Scheduling and Appointment Booking System WordPress plugin. Versions prior to 27.8 fail to sanitize or properly cast a user-supplied parameter in front-end booking requests before including it in a SQL query. Unauthenticated attackers can inject arbitrary SQL and extract sensitive database contents, including WordPress user password hashes. The vulnerability is exploitable over the network without any authentication or user interaction, making any public WordPress site running an affected plugin version reachable to opportunistic scanning.

Critical Impact
Unauthenticated remote attackers can extract password hashes and other sensitive records from the WordPress database via SQL injection in the booking endpoint.

Affected Products

Online Scheduling and Appointment Booking System WordPress plugin versions before 27.8
WordPress sites exposing the plugin's unauthenticated front-end booking functionality
Any WordPress deployment where the vulnerable plugin is installed and active

Discovery Timeline

2026-07-30 - CVE-2026-13395 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13395

Vulnerability Analysis

The flaw is a classic first-order SQL injection [CWE-89] in the plugin's unauthenticated booking workflow. When a visitor submits a booking request, the plugin reads a user-supplied parameter from the HTTP request and concatenates it into a SQL query without sanitization or type casting. Because the input is neither escaped through $wpdb->prepare() nor cast to an integer, an attacker can append arbitrary SQL clauses to the executed statement.

Exploitation does not require credentials, a valid nonce chain from an authenticated session, or user interaction. The booking endpoint is designed to be reached by anonymous site visitors, which is the intended entry point for legitimate customers scheduling appointments. Attackers can leverage UNION-based or time-based blind techniques to extract records from wp_users, including user_login and user_pass fields containing password hashes suitable for offline cracking.

Root Cause

The root cause is missing input validation and unsafe query construction. The vulnerable code path accepts a request parameter, trusts its content, and interpolates it directly into a SQL string. Proper mitigation requires either casting the parameter to its expected type (for example (int)$id) or binding it through prepared statements using $wpdb->prepare() with the correct format specifier.

Attack Vector

The attack vector is a network-reachable HTTP request to the plugin's front-end booking handler. An attacker sends a crafted parameter value containing SQL metacharacters and payloads. Successful exploitation returns injected data through the response body, error messages, or observable timing differences. Refer to the WPScan Vulnerability Report for the specific parameter and endpoint details.

No verified public proof-of-concept code is included in the enriched advisory data, so technical specifics of the payload are described in prose rather than reproduced here.

Detection Methods for CVE-2026-13395

Indicators of Compromise

HTTP POST or GET requests to the plugin's booking endpoint containing SQL keywords such as UNION SELECT, SLEEP(, BENCHMARK(, or information_schema
Anomalous response times on the booking endpoint consistent with time-based blind SQL injection probing
Unexpected database errors in PHP or web server logs referencing the plugin's booking handler
Outbound queries or dumps referencing the wp_users table originating from web-tier processes

Detection Strategies

Inspect web server access logs for booking endpoint requests containing URL-encoded SQL syntax such as %27, %20UNION%20, or --
Deploy WAF rules that flag SQL injection signatures on unauthenticated WordPress plugin endpoints
Correlate spikes in booking endpoint traffic from a single source IP with database error rates
Hunt for repeated failed login attempts following booking endpoint anomalies, which may indicate cracked hashes being replayed

Monitoring Recommendations

Enable MySQL general query logging or slow query logging on WordPress database servers to capture injected payloads
Forward WordPress and web server logs to a centralized analytics platform for retention and correlation
Alert on any query touching wp_users.user_pass that does not originate from expected authentication code paths
Monitor for new administrative user creation or password resets following suspicious booking traffic

How to Mitigate CVE-2026-13395

Immediate Actions Required

Update the Online Scheduling and Appointment Booking System plugin to version 27.8 or later on all WordPress instances
Rotate all WordPress user passwords, prioritizing administrator accounts, on any site that ran a vulnerable version
Review WordPress user tables for unauthorized accounts and audit recent administrative actions
Rotate secrets stored in the database, including API keys and integration tokens that may have been exposed

Patch Information

The vendor addressed the vulnerability in version 27.8 of the Online Scheduling and Appointment Booking System WordPress plugin. Administrators should apply the update through the WordPress plugin manager or by downloading the fixed release directly. Full advisory details are available in the WPScan Vulnerability Report.

Workarounds

If immediate patching is not possible, deactivate the plugin until the update can be applied
Restrict access to the booking endpoint using WAF rules or IP allowlists where the booking form is not required to be publicly reachable
Apply generic SQL injection filtering at the WAF for URL parameters targeting the plugin's request handler
Enforce database-level least privilege so the WordPress database user cannot access tables outside the WordPress schema

bash

# Example: block requests containing common SQL injection tokens targeting the plugin endpoint
# ModSecurity rule (illustrative)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1013395,msg:'Possible SQLi against booking plugin'"
  SecRule ARGS "@rx (?i)(union[\s/*]+select|sleep\s*\(|information_schema|--\s|;\s*drop)" "t:none,t:urlDecode"