CVE-2026-68566: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Repute Infosystems BookingPress Appointment Booking Pro

This vulnerability (CVE-2026-68566) involves improper neutralization of special elements used in SQL commands (CWE-89) in the BookingPress Appointment Booking Pro plugin for WordPress. It affects versions up to 6.0.2 and can be exploited without authentication. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact). The integrity of data is not impacted according to the CVSS vector, but availability may be slightly affected (low impact).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider applying any recommended temporary mitigations from the vendor or restricting access to vulnerable endpoints if possible.