CVE-2026-14516 describes a time-based SQL Injection vulnerability in the ladela Online Scheduling and Appointment Booking System – Bookly WordPress plugin affecting all versions up to and including 27.5. The issue arises from improper neutralization of special elements in the 'staff_ids' parameter, which is insufficiently escaped and used in SQL queries without proper preparation. An attacker can exploit this by first invoking the unauthenticated 'bookly_get_form_id' action to seed a booking session with malicious 'staff_ids' values, then triggering 'bookly_render_time' to execute the tainted query. Both endpoints lack CSRF and nonce validation, allowing cross-site exploitation. This vulnerability enables extraction of sensitive database information without authentication.

Successful exploitation allows unauthenticated attackers to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. The lack of CSRF/nonce protections on involved endpoints increases the attack surface by enabling cross-site request forgery attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoints if possible and monitor for suspicious activity. Due to the absence of CSRF/nonce validation, implementing such protections on the affected endpoints would mitigate the attack vector. Avoid exposing the 'bookly_get_form_id' and 'bookly_render_time' actions to unauthenticated users if feasible.