CVE-2026-13395

Vulnerability Description

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

Vulnerability Details

Published Date

July 30, 2026

Last Modified

July 30, 2026

Source

NVD

Vendor

Unknown

Product

Online Scheduling and Appointment Booking System

External References

https://wpscan.com/vulnerability/87e75d83-0ffc-4dd1-8839-1d5a90f5ea73/

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment