This vulnerability (CVE-2026-68566) is an unauthenticated SQL Injection flaw in BookingPress Appointment Booking Pro, specifically in versions up to 6.0.2. It stems from improper neutralization of special elements used in SQL commands (CWE-89), enabling attackers to inject malicious SQL queries remotely without authentication. The CVSS 3.1 vector indicates it can be exploited over the network with low complexity and no privileges, resulting in a complete confidentiality breach and some availability impact. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, leading to a complete loss of confidentiality of the data and partial availability impact. This could expose sensitive booking and user information stored by the BookingPress plugin. The integrity impact is not indicated, suggesting data modification or deletion is not confirmed. The vulnerability is critical due to ease of exploitation and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable BookingPress Appointment Booking Pro plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.