CVE-2026-73365: JetAppointment SQLi Vulnerability

CVE-2026-73365 Overview

CVE-2026-73365 is an unauthenticated SQL Injection vulnerability affecting the JetAppointment (Jet Appointments Booking) WordPress plugin in versions up to and including 2.5.2. The flaw is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Attackers can send crafted requests over the network without authentication or user interaction. Successful exploitation allows manipulation of backend SQL queries, exposing database contents and enabling limited impact to service availability. The vulnerability was published to the National Vulnerability Database on 2026-08-18.

Critical Impact
Remote, unauthenticated attackers can inject SQL statements into JetAppointment <= 2.5.2, exposing WordPress database contents including user records and booking data.

Affected Products

JetAppointment (Jet Appointments Booking) WordPress plugin versions <= 2.5.2
WordPress installations running the vulnerable plugin
Sites using JetAppointment booking workflows exposed to unauthenticated visitors

Discovery Timeline

2026-08-18 - CVE-2026-73365 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73365

Vulnerability Analysis

The vulnerability is a SQL Injection flaw ([CWE-89]) in the JetAppointment WordPress plugin. Unauthenticated attackers can inject SQL syntax through user-controlled parameters that reach database queries without proper sanitization or parameterization. Because no authentication or user interaction is required, exploitation can be automated at scale against exposed WordPress sites. The scope is marked as changed, indicating the injected query can affect resources beyond the vulnerable component's security boundary. The EPSS probability is 0.383% as of 2026-08-21.

Root Cause

The root cause is improper neutralization of special SQL elements within input handling routines of the JetAppointment plugin. User-supplied data is concatenated into SQL statements rather than bound as parameterized values. This allows attacker-controlled strings to alter query structure and logic. Refer to the Patchstack SQL Injection Advisory for technical specifics of the affected code path.

Attack Vector

An attacker sends HTTP requests to a vulnerable WordPress endpoint exposed by the JetAppointment plugin. Injected SQL payloads modify query semantics, permitting extraction of database rows, enumeration of schema objects, and read access to sensitive WordPress tables such as wp_users and wp_options. The CVSS impact profile indicates high confidentiality impact, no integrity impact, and low availability impact. No public exploit code or proof-of-concept has been catalogued in the provided data.

No verified public exploit code is available. See the Patchstack SQL Injection Advisory for further technical detail.

Detection Methods for CVE-2026-73365

Indicators of Compromise

Unexpected HTTP requests to JetAppointment endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, INFORMATION_SCHEMA, or encoded variants.
Anomalous database query patterns, long-running queries, or spikes in error log entries referencing the plugin.
Outbound requests to unfamiliar hosts originating from the WordPress server following suspicious inbound traffic.

Detection Strategies

Deploy web application firewall rules that detect SQL injection payloads targeting plugin request parameters.
Correlate WordPress access logs with database slow-query logs to surface injection attempts and successful extractions.
Monitor plugin file integrity and version banners to confirm the JetAppointment version in production.

Monitoring Recommendations

Alert on unauthenticated requests to booking endpoints that include SQL metacharacters or time-based delay functions.
Track baseline row counts and query volumes on wp_users, booking, and appointment tables for exfiltration anomalies.
Forward WordPress, PHP-FPM, and MySQL logs to a centralized SIEM for cross-source correlation.

How to Mitigate CVE-2026-73365

Immediate Actions Required

Inventory all WordPress sites and confirm whether JetAppointment is installed and its exact version.
Update JetAppointment to a version later than 2.5.2 as soon as the vendor patch is validated in a staging environment.
Rotate WordPress administrator passwords and API keys if exploitation is suspected.

Patch Information

Consult the Patchstack SQL Injection Advisory for the fixed release and patch details. Upgrade to the vendor-supplied version that supersedes 2.5.2. Validate the upgrade in a non-production environment and confirm that booking workflows continue to function after applying the patch.

Workarounds

Temporarily disable the JetAppointment plugin on internet-facing sites until the patched version is deployed.
Deploy a WAF ruleset that blocks SQL injection payloads targeting plugin endpoints if patching must be deferred.
Restrict access to booking endpoints through IP allow-listing or authentication proxies where operationally feasible.

bash

# Example: identify JetAppointment plugin version via WP-CLI
wp plugin get jet-appointments-booking --field=version

# Update the plugin once a fixed release is available
wp plugin update jet-appointments-booking

# Temporarily deactivate the plugin as a workaround
wp plugin deactivate jet-appointments-booking