Bookly WordPress Plugin SQL Injection via Staff IDs Parameter

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a two-request chain: an attacker first calls the unauthenticated bookly_get_form_id action to seed a booking session carrying malicious staff_ids values, then triggers bookly_render_time to cause the tainted array to reach the vulnerable query; CSRF/nonce validation is absent on both endpoints, meaning this chain can be initiated cross-site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Bookly WordPress scheduling plugin contains a time-based SQL injection vulnerability in the 'staff_ids' parameter affecting all versions through 27.5. Because the parameter lacks proper escaping and SQL query preparation, unauthenticated attackers can inject malicious SQL commands to extract sensitive database information without authentication. This is particularly dangerous for WordPress installations managing business appointments, as it exposes customer data, staff information, and potentially payment details stored in the database. With over 50,000+ active installations, this vulnerability represents a significant attack surface for threat actors seeking to compromise WordPress environments or steal customer information.

Casky's 322 matched skills leverage Claude's extended reasoning to detect the attack patterns mapped to MITRE techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) by analyzing SQL injection payloads and time-based data exfiltration patterns. Practitioners using Casky would observe detection patterns identifying: (1) abnormal parameter manipulation in HTTP requests to Bookly endpoints, particularly time-based delays in responses indicating blind SQL injection attempts; (2) database query anomalies showing injected SQL syntax within the staff_ids field; and (3) suspicious database enumeration activities extracting schema and table information. The platform's skill coverage would flag unauthenticated access attempts to vulnerable endpoints combined with timing-based behavioral analysis, enabling security teams to identify exploitation attempts before sensitive data extraction occurs and to prioritize patching this high-severity vulnerability across their WordPress deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14516.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-14516

Casky has 322 skills that investigate the attack patterns behind CVE-2026-14516. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn