CVE-2024-11726: 
WordPress vulnerability analysis and mitigation

The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress contains a SQL Injection vulnerability (CVE-2024-11726) discovered in December 2024. The vulnerability affects all versions up to and including 1.1.21, where the 'category' parameter of the 'bookingpress_form' shortcode is susceptible to SQL injection attacks (NVD).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries in the 'category' parameter of the 'bookingpress_form' shortcode. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD, Wordfence).

The vulnerability allows authenticated attackers with Contributor-level access or higher to append additional SQL queries to existing ones, potentially enabling the extraction of sensitive information from the database (NVD).

The vulnerability requires authentication with at least Contributor-level access to exploit. The attack can be executed remotely by appending malicious SQL queries to existing database queries (NVD).

Users should update to a version newer than 1.1.21 if available. A patch has been implemented as evidenced by the WordPress plugin repository changes (WordPress Plugin).