Skip to content
Threat Feed
Subscribe

Vendor

Bookly

1 brief RSS
high advisory

CVE-2026-14516 - Bookly WordPress Plugin Time-Based SQL Injection

Unauthenticated attackers can exploit a time-based SQL Injection vulnerability (CVE-2026-14516) in the Bookly WordPress plugin, affecting versions up to and including 27.5, via the 'staff_ids' parameter, chaining requests to `bookly_get_form_id` and `bookly_render_time` to extract sensitive database information due to insufficient input escaping and lack of CSRF protection.

Bookly plugin for WordPress <= 27.5 web sql-injection wordpress plugin vulnerability cve exfiltration
1r 2t 1c