CVE-2026-14516 Overview
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress contains a time-based SQL injection vulnerability in the staff_ids parameter. The flaw affects all versions up to and including 27.5. Unauthenticated attackers can append additional SQL queries to existing statements and extract sensitive database contents. Exploitation requires a two-request chain: an attacker first calls the unauthenticated bookly_get_form_id action to seed a booking session carrying malicious staff_ids values, then triggers bookly_render_time to force the tainted array into the vulnerable query. Neither endpoint validates CSRF tokens or nonces, so the chain can be initiated cross-site [CWE-89].
Critical Impact
Unauthenticated attackers can extract database contents including WordPress user credentials, session tokens, and personally identifiable information stored by the booking plugin.
Affected Products
- Bookly – Online Scheduling and Appointment Booking System plugin for WordPress
- All versions up to and including 27.5
- WordPress sites exposing the bookly_get_form_id and bookly_render_time AJAX endpoints
Discovery Timeline
- 2026-07-28 - CVE-2026-14516 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-14516
Vulnerability Analysis
The vulnerability resides in the frontend booking module of the Bookly plugin. The staff_ids parameter, submitted through the unauthenticated bookly_get_form_id AJAX action, is stored in a booking session without adequate escaping or type coercion. When the follow-on bookly_render_time action is invoked, the tainted array is passed into a downstream SQL query in lib/slots/Finder.php that lacks a prepared statement. The attacker controls the injected SQL fragment and observes execution timing to infer database contents.
The two-stage flow is significant. The first request establishes attacker-controlled state, and the second request consumes that state inside a vulnerable query path. Because neither AJAX endpoint enforces CSRF nonces, an attacker can trigger the chain from an off-site page loaded by any visitor, extending the attack surface beyond direct network requests.
Root Cause
The root cause is insufficient escaping of user-supplied input combined with missing parameterization in the SQL statement that consumes staff_ids. The plugin trusts values placed in the booking session as if they were internally generated identifiers, even though they originated from unauthenticated HTTP input.
Attack Vector
Exploitation is network-based, requires no authentication, and needs no user interaction on the target account. An attacker sends a crafted POST to admin-ajax.php with action=bookly_get_form_id and a malicious staff_ids array, then sends a second request with action=bookly_render_time referencing the seeded form identifier. Time-based blind extraction is achieved by embedding SLEEP() or equivalent constructs and measuring response latency.
See the Wordfence Vulnerability Report and the Bookly Ajax.php source for the vulnerable code path.
Detection Methods for CVE-2026-14516
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=bookly_get_form_id containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the staff_ids parameter
- Sequential AJAX calls pairing bookly_get_form_id and bookly_render_time from the same client IP within a short window
- Elevated response times on bookly_render_time requests, consistent with time-based blind SQL injection
- Unusually large volumes of unauthenticated admin-ajax.php requests targeting Bookly actions
Detection Strategies
- Inspect web server access logs for staff_ids[] values containing non-numeric characters, encoded quotes, or SQL syntax
- Deploy WAF signatures that flag SQL keywords in admin-ajax.php parameters associated with Bookly actions
- Correlate paired bookly_get_form_id and bookly_render_time requests from the same source and alert on repeated pairs
Monitoring Recommendations
- Baseline normal admin-ajax.php request latency and alert on sustained deviations tied to Bookly endpoints
- Enable MySQL general or slow query logging on affected hosts and review queries referencing Bookly staff selection tables
- Track outbound data volume from the WordPress database host for signs of bulk extraction
How to Mitigate CVE-2026-14516
Immediate Actions Required
- Update the Bookly plugin to a version newer than 27.5 as soon as the vendor publishes a fixed release
- If no patched version is available, disable or uninstall the Bookly plugin on internet-facing WordPress sites
- Rotate WordPress administrator passwords and API keys if evidence of exploitation exists
- Review database audit logs for anomalous SELECT activity against Bookly tables
Patch Information
At the time of publication, the NVD entry lists no fixed version. Monitor the Wordfence advisory and the Bookly plugin repository for a security release beyond version 27.5. Apply the update through the WordPress plugin management interface once available.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php at the WAF layer for the bookly_get_form_id and bookly_render_time actions
- Add virtual patching rules that reject non-integer values in the staff_ids parameter
- Place the WordPress site behind an authenticating reverse proxy for staff-only booking deployments where public access is unnecessary
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
