CVE-2025-13385

Name of the Vulnerable Software and Affected Versions Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress versions prior to 4.3

Description The Bookme plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate input sanitization of the filter[status] parameter, allowing authenticated attackers with admin-level access or higher to inject additional SQL queries into existing database queries. This can lead to the extraction of sensitive information from the database.

Recommendations Update Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress to version 4.3 or later.