CVE-2026-14516

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 27.6

Description The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress contains a time-based SQL Injection. This occurs because the staff ids parameter is not sufficiently escaped and the SQL query is not properly prepared. Unauthenticated attackers can append malicious SQL queries to extract sensitive information from the database. The attack involves a two-request chain: first, calling the bookly get form id action to seed a booking session with malicious staff ids values, and second, triggering bookly render time to execute the query. Both endpoints lack CSRF and nonce validation, allowing the attack to be initiated cross-site.

Recommendations Update the plugin to version 27.6 or later. As a temporary mitigation, restrict access to the bookly get form id and bookly render time actions if possible.