WordPress BookingPress Plugin SQL Injection via Service Date Parameter

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

BookingPress Appointment Booking Pro, a popular WordPress plugin for managing appointment scheduling, contains a critical SQL injection vulnerability in versions up to 5.7.1. The vulnerability exists in the bpa_assign_staffmember_to_slots() function where user-supplied POST data from the 'store_service_date' parameter is processed with stripslashes_deep() and then directly interpolated into a SQL LIKE clause without proper parameterization or use of WordPress's $wpdb->prepare() function. This allows unauthenticated attackers to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of sensitive booking information, customer details, and payment records. Any WordPress installation running this plugin version is at risk, affecting thousands of small businesses, healthcare providers, and service-based enterprises that rely on BookingPress for client scheduling.

Casky's 322 matched skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability across both MITRE ATT&CK Initial Access (TA0001) and Discovery (TA0043) techniques. Practitioners using Casky would observe skill findings that correlate suspicious SQL syntax patterns in HTTP POST parameters with CWE-89 (SQL Injection) indicators, identify unauthenticated API endpoint access attempts targeting the vulnerable bpa_assign_staffmember_to_slots() function, and detect reconnaissance queries probing database schema through error-based SQL injection. The platform's skills would flag POST requests containing SQL keywords (UNION, SELECT, OR, --) in the store_service_date parameter, recognize attempts to bypass input validation through encoding evasion, and surface behavioral anomalies indicating database enumeration or lateral movement attempts following successful injection, enabling rapid threat response before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11823.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

achieving-cmmc-level-2-compliance

compliance governance · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-11823

Casky has 322 skills that investigate the attack patterns behind CVE-2026-11823. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn