Bookly < 22.4 - Admin+ SQLi

CVE-2023-4691

Summary

The WordPress Online Booking and Scheduling Plugin prior to version 22.4 is susceptible to a SQL injection vulnerability. This occurs due to improper sanitization and escaping of parameters, particularly exploitable by users with elevated privileges, such as administrators. If an attacker gains access, they could manipulate backend SQL queries, potentially leading to unauthorized data access or alterations. It is critical for users to update to the latest version to mitigate this risk and ensure the integrity of their scheduling systems.

References