Summary
CVE-2026-68566 is an unauthenticated SQL Injection (CWE-89) vulnerability affecting the BookingPress Appointment Booking Pro WordPress plugin, developed by Repute Infosystems, in versions up to and including 6.0.2. The flaw allows a remote, unauthenticated attacker to inject malicious SQL through the plugin’s booking functionality, potentially exposing sensitive database contents. The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical).
Technical details
- Root cause: improper neutralization of user-supplied input before it is used in a SQL query (CWE-89), consistent with a blind SQL injection pattern (CAPEC-7).
- Trigger conditions: no authentication or user interaction is required to exploit the flaw.
- Attack vector: network-based, exploitable directly against the plugin’s exposed endpoints on a WordPress site running the affected versions.
- Impact: the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates a scope change with high confidentiality impact and low availability impact, meaning an attacker could extract data (e.g., credentials, booking/customer records) from the underlying database and potentially affect components beyond the vulnerable module.
Affected software
- BookingPress Appointment Booking Pro (WordPress plugin) — all versions up to and including 6.0.2.
Severity
- CVSS v3.1 Base Score: 9.3 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Mitigation and recommended actions
- Immediate: Update BookingPress Appointment Booking Pro to the latest version released by Repute Infosystems. At the time of publication, the vendor’s most recent release is 6.1 (August 20, 2026); confirm that the installed version is newer than 6.0.2 and includes a fix for this issue.
- If immediate patching is not possible: restrict or disable public access to the plugin’s booking-related endpoints, deploy a web application firewall rule to block SQL injection patterns targeting the plugin, and monitor database logs for anomalous query activity.
- General: Regularly audit installed WordPress plugins and apply vendor updates promptly, especially for plugins handling customer-facing forms and unauthenticated input.

