CVE-2026-15289

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System plugin for WordPress versions prior to 3.2.18

Description An issue exists where unauthenticated attackers can perform time-based SQL Injection, a technique used to infer data from a database by observing the time it takes for the server to respond to specific queries. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. The flaw allows attackers to append additional SQL queries to extract sensitive information from the database. Exploitation requires the Pro version of the plugin to be active and the 'Delete previous dates' option to be enabled. The vulnerability is triggered via the wpdevart id parameter.

Recommendations Update the plugin to version 3.2.18 or later. As a temporary mitigation, disable the 'Delete previous dates' option in the Pro version settings.