CVE-2026-13454: MotoPress Appointment Booking SQLi Flaw

CVE-2026-13454 Overview

CVE-2026-13454 is an authenticated SQL injection vulnerability in the MotoPress Appointment Booking plugin for WordPress. The flaw affects all versions up to and including 2.4.5. It stems from insufficient escaping of the s parameter and missing query preparation in the ManageBookingsPage.php handler. Attackers holding the mpa_appointment_employee custom role can append arbitrary SQL clauses to existing queries. Successful exploitation allows extraction of sensitive database contents, including credentials and personally identifiable information (PII) stored in the WordPress database. The issue is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated users with the mpa_appointment_employee custom role can execute injected SQL to read arbitrary data from the WordPress database.

Affected Products

MotoPress Appointment Booking plugin for WordPress, versions ≤ 2.4.5
MotoPress Appointment Booking Lite plugin variants sharing the same ManageBookingsPage.php code path
WordPress installations granting the mpa_appointment_employee custom role to non-trusted users

Discovery Timeline

2026-07-01 - CVE-2026-13454 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13454

Vulnerability Analysis

The vulnerability resides in the plugin's booking management interface. The s search parameter, submitted through the admin booking listing page, flows into a SQL query without proper escaping or parameterized binding. The affected code paths sit at lines 247 and 310 of includes/admin-pages/manage/ManageBookingsPage.php in versions 2.4.3 and 2.4.5. Because the query is concatenated rather than prepared using $wpdb->prepare(), attacker-controlled input alters the query structure. This grants read access to arbitrary tables in the WordPress database.

Root Cause

The root cause is missing input sanitization combined with unsafe query construction. The plugin trusts the s request parameter and inserts it directly into a SQL statement executed by the WordPress database abstraction layer. WordPress provides $wpdb->prepare() for safe parameterization, but this code path bypasses it. The result is a classic first-order SQL injection [CWE-89].

Attack Vector

Exploitation requires an authenticated session under the mpa_appointment_employee role or higher. The attacker submits a crafted s value to the booking management endpoint, embedding SQL syntax such as UNION SELECT clauses to exfiltrate rows from tables like wp_users or wp_usermeta. No user interaction is required beyond the attacker's own request. The attack occurs over the network against the WordPress admin interface.

No verified public exploit code is available. Technical details of the vulnerable code paths are documented in the Wordfence Vulnerability Report and the WordPress Plugin Changeset.

Detection Methods for CVE-2026-13454

Indicators of Compromise

HTTP requests to WordPress admin booking pages containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA inside the s query parameter
Unexpected access to wp-admin pages by accounts assigned the mpa_appointment_employee role
Database query logs showing malformed or unusually long SELECT statements originating from the MotoPress plugin handler

Detection Strategies

Enable WordPress query logging or a Web Application Firewall (WAF) rule that inspects the s parameter for SQL metacharacters on MotoPress booking endpoints
Correlate authenticated user activity with sudden bulk reads of wp_users, wp_usermeta, or wp_options tables
Review MotoPress plugin version inventory across all managed WordPress sites and flag any instance at or below version 2.4.5

Monitoring Recommendations

Alert on any HTTP 200 response to booking management URLs where the s parameter contains ', --, /*, or SQL keywords
Monitor creation or assignment of the mpa_appointment_employee role to accounts outside the expected staff list
Ingest WordPress access logs into a centralized data lake for retroactive hunting on the s parameter pattern

How to Mitigate CVE-2026-13454

Immediate Actions Required

Update the MotoPress Appointment Booking plugin to a version later than 2.4.5 that includes the fix from WordPress Plugin Changeset 3591693
Audit all accounts assigned the mpa_appointment_employee role and remove the role from users who do not require it
Rotate WordPress administrator and database credentials if exploitation is suspected

Patch Information

The vendor addressed the flaw in the changeset committed to the plugin trunk. Review the WordPress Plugin Changeset for the exact code changes that introduce proper escaping and prepared statements around the s parameter. Refer to the Wordfence Vulnerability Report for the fixed version reference.

Workarounds

Restrict access to the WordPress admin interface using IP allow-listing at the web server or firewall level
Deploy a WAF rule that blocks SQL metacharacters in the s parameter on MotoPress booking endpoints until patching is complete
Temporarily revoke the mpa_appointment_employee custom role from all non-essential accounts

bash

# Example WordPress CLI commands to audit and remediate
wp plugin get motopress-appointment-lite --field=version
wp plugin update motopress-appointment-lite
wp user list --role=mpa_appointment_employee --fields=ID,user_login,user_email