CVE-2026-13454 describes a SQL Injection vulnerability in the MotoPress Appointment Booking plugin for WordPress affecting all versions up to and including 2.4.5. The flaw exists due to improper neutralization of special elements in the 's' parameter, allowing authenticated users with the mpa_appointment_employee role to inject additional SQL commands. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability requires authenticated access with a specific custom role and does not affect unauthenticated users. No vendor advisory or patch is currently available to address this issue.

An attacker with the mpa_appointment_employee role can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands via the 's' parameter. The impact is limited to confidentiality loss; integrity and availability are not affected according to the CVSS vector. The attack requires authenticated access with a specific custom role, reducing the attack surface compared to unauthenticated vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict assignment of the mpa_appointment_employee role to trusted users only and monitor for suspicious activity involving this role. Avoid using the vulnerable plugin versions in sensitive environments.