CVE-2024-11726: 
WordPress vulnerability analysis and mitigation

The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress contains a SQL Injection vulnerability (CVE-2024-11726) discovered in December 2024. The vulnerability affects all versions up to and including 1.1.21, where the 'category' parameter of the 'bookingpress_form' shortcode is susceptible to SQL injection attacks (NVD).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries in the 'category' parameter of the 'bookingpress_form' shortcode. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD, Wordfence).

The vulnerability allows authenticated attackers with Contributor-level access or higher to append additional SQL queries to existing ones, potentially enabling the extraction of sensitive information from the database (NVD).

Users should update to a version newer than 1.1.21 if available. A patch has been implemented as evidenced by the WordPress plugin repository changes (WordPress Plugin).