CVE-2026-13395 is a SQL injection vulnerability (CWE-89) in the Online Scheduling and Appointment Booking System WordPress plugin prior to version 27.8. The vulnerability arises from improper input validation and sanitization of a user-supplied parameter in unauthenticated booking requests, which is directly used in SQL queries. This allows attackers without authentication to execute arbitrary SQL commands, potentially leading to unauthorized data disclosure including sensitive information like password hashes.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the plugin's database. This may result in unauthorized disclosure of sensitive data, including password hashes, which could lead to further compromise of user accounts or the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 27.8, upgrading to version 27.8 or later is likely to address the issue once an official fix is released. Until then, restrict access to the affected plugin or disable it if possible to mitigate risk.