CVE-2026-11823

Name of the Vulnerable Software and Affected Versions BookingPress Appointment Booking Pro versions prior to 5.7.2

Description An issue exists where unauthenticated attackers can execute additional SQL queries to extract sensitive information from the database. This occurs because user-supplied POST data is processed using the stripslashes deep() function and then inserted directly into a SQL LIKE clause without using $wpdb->prepare() or parameterization. The flaw is located within the bpa assign staffmember to slots() function, specifically affecting the store service date parameter.

Recommendations Update BookingPress Appointment Booking Pro to version 5.7.2 or later. As a temporary mitigation, restrict access to the functionality utilizing the bpa assign staffmember to slots() function.