CVE-2026-13454 describes an SQL Injection vulnerability in the MotoPress Appointment Booking plugin for WordPress affecting all versions up to 2.4.5. The issue is due to improper neutralization of special elements in the 's' parameter, which is used in SQL commands without sufficient escaping or prepared statements. Authenticated users with the mpa_appointment_employee role can exploit this to append arbitrary SQL queries to existing ones, potentially extracting sensitive data from the database. The vulnerability requires at least custom-level privileges and does not affect unauthenticated users.

An attacker with the mpa_appointment_employee role can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The vulnerability does not impact availability or integrity but compromises confidentiality. The attack requires authenticated access with specific privileges, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a patch is available, restrict assignment of the mpa_appointment_employee role to trusted users only to reduce risk.