SQL Injection Vulnerability in Bookly Online Scheduling Plugin

CVE-2026-14516

What is CVE-2026-14516?

The Bookly plugin for WordPress is susceptible to a time-based SQL Injection flaw through the 'staff_ids' parameter. This vulnerability arises from inadequate escaping of user-supplied input and poor handling of the SQL query preparation. Attackers, without authentication, are capable of appending additional SQL queries to existing ones, enabling them to access sensitive information stored in the database. The exploitation process involves a two-step request: first, the attacker initiates the unauthenticated 'bookly_get_form_id' action to start a booking session with malicious 'staff_ids' values. Subsequently, they trigger 'bookly_render_time', allowing the manipulated data to enter the vulnerable SQL query. Notably, there is no CSRF or nonce validation on both involved endpoints, which facilitates cross-site attacks.

References