SQL Injection Vulnerability in BookingPress Plugin

CVE-2024-10540

Summary

The Appointment Booking Calendar Plugin and Scheduling Plugin, known as the BookingPress plugin for WordPress, is vulnerable to SQL Injection through the 'service' parameter of the 'bookingpress_form' shortcode. This vulnerability arises from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to inject additional SQL queries into existing requests, potentially enabling them to extract sensitive database information. Website administrators are advised to review their current versions and apply necessary updates to mitigate this security risk.

References