CVE-2026-14516 - Bookly WordPress Plugin Time-Based SQL Injection

The Online Scheduling and Appointment Booking System - Bookly plugin for WordPress, in versions up to and including 27.5, is affected by a time-based SQL Injection vulnerability, tracked as CVE-2026-14516. This flaw resides in the 'staff_ids' parameter, which is improperly escaped and used in an existing SQL query without sufficient preparation. Unauthenticated attackers can leverage this vulnerability to extract sensitive information from the underlying database. The exploitation involves a two-step request chain: first, the attacker calls the bookly_get_form_id action to seed a booking session with malicious staff_ids values. Subsequently, they trigger the bookly_render_time endpoint, which causes the tainted data to reach the vulnerable SQL query. The absence of CSRF and nonce validation on both endpoints significantly facilitates this attack, allowing for cross-site exploitation. This vulnerability poses a critical risk as it enables unauthorized data exfiltration from WordPress sites utilizing the affected plugin.

Attack Chain

1. An unauthenticated attacker identifies a WordPress website running a vulnerable version of the Bookly plugin (up to and including 27.5).
2. The attacker crafts an HTTP GET or POST request targeting the /wp-admin/admin-ajax.php endpoint with the action=bookly_get_form_id parameter. This request includes a staff_ids[] array parameter containing a time-based SQL injection payload (e.g., ' OR SLEEP(5)--).
3. Due to insufficient input escaping and lack of proper SQL query preparation, the Bookly plugin processes this request and seeds a booking session with the malicious staff_ids value, effectively injecting the payload into the session data.
4. The attacker then sends a second HTTP GET or POST request to the same /wp-admin/admin-ajax.php endpoint, this time with the action=bookly_render_time parameter, which references the session initiated in the previous step.
5. The bookly_render_time action executes a vulnerable SQL query that incorporates the previously tainted staff_ids array, causing the injected time-based payload (e.g., SLEEP(5)) to execute within the database.
6. The attacker observes a noticeable delay in the server's HTTP response time, confirming the execution of the SQL injection. By iteratively modifying the payload and observing response times, the attacker can progressively infer and extract sensitive information from the database (e.g., user credentials, customer data, plugin configuration).
7. The absence of CSRF and nonce validation on both bookly_get_form_id and bookly_render_time endpoints allows this two-step attack to be initiated from a malicious third-party website, making it a cross-site attack vector.
8. The attacker successfully exfiltrates sensitive database information, compromising the confidentiality of the WordPress site's data.

Impact

The successful exploitation of CVE-2026-14516 allows unauthenticated attackers to extract sensitive information from the database of affected WordPress sites. This can include, but is not limited to, customer details, booking information, and potentially hashed credentials or other confidential data stored by the Bookly plugin or WordPress itself. Given that the vulnerability facilitates a cross-site attack due to absent CSRF/nonce validation, a wide range of websites using the plugin could be targeted, leading to significant data breaches and privacy violations.

Recommendation

• Update the Bookly plugin for WordPress to a version greater than 27.5 immediately to patch CVE-2026-14516.
• Deploy the provided Sigma rule to detect suspicious web requests indicative of CVE-2026-14516 exploitation attempts.
• Monitor webserver logs for unusual HTTP GET or POST requests to /wp-admin/admin-ajax.php containing action=bookly_get_form_id or action=bookly_render_time combined with SQL injection patterns in the staff_ids[] parameter.