{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/bookly/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-14516"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bookly plugin for WordPress \u003c= 27.5"],"_cs_severities":["high"],"_cs_tags":["web","sql-injection","wordpress","plugin","vulnerability","cve","exfiltration"],"_cs_type":"advisory","_cs_vendors":["Bookly"],"content_html":"\u003cp\u003eThe Online Scheduling and Appointment Booking System - Bookly plugin for WordPress, in versions up to and including 27.5, is affected by a time-based SQL Injection vulnerability, tracked as CVE-2026-14516. This flaw resides in the 'staff_ids' parameter, which is improperly escaped and used in an existing SQL query without sufficient preparation. Unauthenticated attackers can leverage this vulnerability to extract sensitive information from the underlying database. The exploitation involves a two-step request chain: first, the attacker calls the \u003ccode\u003ebookly_get_form_id\u003c/code\u003e action to seed a booking session with malicious \u003ccode\u003estaff_ids\u003c/code\u003e values. Subsequently, they trigger the \u003ccode\u003ebookly_render_time\u003c/code\u003e endpoint, which causes the tainted data to reach the vulnerable SQL query. The absence of CSRF and nonce validation on both endpoints significantly facilitates this attack, allowing for cross-site exploitation. This vulnerability poses a critical risk as it enables unauthorized data exfiltration from WordPress sites utilizing the affected plugin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a WordPress website running a vulnerable version of the Bookly plugin (up to and including 27.5).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP GET or POST request targeting the \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e endpoint with the \u003ccode\u003eaction=bookly_get_form_id\u003c/code\u003e parameter. This request includes a \u003ccode\u003estaff_ids[]\u003c/code\u003e array parameter containing a time-based SQL injection payload (e.g., \u003ccode\u003e' OR SLEEP(5)--\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDue to insufficient input escaping and lack of proper SQL query preparation, the Bookly plugin processes this request and seeds a booking session with the malicious \u003ccode\u003estaff_ids\u003c/code\u003e value, effectively injecting the payload into the session data.\u003c/li\u003e\n\u003cli\u003eThe attacker then sends a second HTTP GET or POST request to the same \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e endpoint, this time with the \u003ccode\u003eaction=bookly_render_time\u003c/code\u003e parameter, which references the session initiated in the previous step.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebookly_render_time\u003c/code\u003e action executes a vulnerable SQL query that incorporates the previously tainted \u003ccode\u003estaff_ids\u003c/code\u003e array, causing the injected time-based payload (e.g., \u003ccode\u003eSLEEP(5)\u003c/code\u003e) to execute within the database.\u003c/li\u003e\n\u003cli\u003eThe attacker observes a noticeable delay in the server's HTTP response time, confirming the execution of the SQL injection. By iteratively modifying the payload and observing response times, the attacker can progressively infer and extract sensitive information from the database (e.g., user credentials, customer data, plugin configuration).\u003c/li\u003e\n\u003cli\u003eThe absence of CSRF and nonce validation on both \u003ccode\u003ebookly_get_form_id\u003c/code\u003e and \u003ccode\u003ebookly_render_time\u003c/code\u003e endpoints allows this two-step attack to be initiated from a malicious third-party website, making it a cross-site attack vector.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully exfiltrates sensitive database information, compromising the confidentiality of the WordPress site's data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-14516 allows unauthenticated attackers to extract sensitive information from the database of affected WordPress sites. This can include, but is not limited to, customer details, booking information, and potentially hashed credentials or other confidential data stored by the Bookly plugin or WordPress itself. Given that the vulnerability facilitates a cross-site attack due to absent CSRF/nonce validation, a wide range of websites using the plugin could be targeted, leading to significant data breaches and privacy violations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Bookly plugin for WordPress to a version greater than 27.5 immediately to patch CVE-2026-14516.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious web requests indicative of CVE-2026-14516 exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for unusual HTTP GET or POST requests to \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e containing \u003ccode\u003eaction=bookly_get_form_id\u003c/code\u003e or \u003ccode\u003eaction=bookly_render_time\u003c/code\u003e combined with SQL injection patterns in the \u003ccode\u003estaff_ids[]\u003c/code\u003e parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T09:23:53Z","date_published":"2026-07-28T09:23:53Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14516-bookly-sql/","summary":"Unauthenticated attackers can exploit a time-based SQL Injection vulnerability (CVE-2026-14516) in the Bookly WordPress plugin, affecting versions up to and including 27.5, via the 'staff_ids' parameter, chaining requests to `bookly_get_form_id` and `bookly_render_time` to extract sensitive database information due to insufficient input escaping and lack of CSRF protection.","title":"CVE-2026-14516 - Bookly WordPress Plugin Time-Based SQL Injection","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14516-bookly-sql/"}],"language":"en","title":"CraftedSignal Threat Feed - Bookly","version":"https://jsonfeed.org/version/1.1"}