CVE-2026-32557: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Bot Verification bookingwp.com: Verifying that you are not a robot... WooCommerce Appointments

This vulnerability (CVE-2026-32557) is an unauthenticated SQL Injection in WooCommerce Appointments (versions <= 5.3.2) related to the Bot Verification feature 'Verifying that you are not a robot...' from bookingwp.com. It allows attackers to inject SQL commands without any authentication, potentially compromising database confidentiality and causing partial denial of service. The CVSS 3.1 score is 9.3 (critical), with attack vector network, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

An unauthenticated attacker can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). There is no reported integrity impact. The vulnerability affects the security posture of WooCommerce Appointments installations up to version 5.3.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected WooCommerce Appointments plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted networks if possible.