CVE-2025-14383: 
WordPress vulnerability analysis and mitigation

CVE-2025-14383 is a time-based blind SQL Injection vulnerability in the Booking Calendar plugin for WordPress, affecting all versions up to and including 10.14.8. The flaw exists in the dates_to_check parameter and allows unauthenticated remote attackers to extract sensitive information from the underlying database. It was published on December 15, 2025, and assigned a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from insufficient escaping of user-supplied input in the dates_to_check parameter combined with a lack of proper SQL query preparation (Wordfence). Because the injection is time-based and blind, attackers cannot directly observe query output but can infer database contents by measuring server response delays. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity. A patch was applied in the plugin's source repository, specifically in includes/_capacity/capacity.php (WordPress Trac).

Successful exploitation allows unauthenticated attackers to extract sensitive information from the WordPress database, potentially including user credentials (hashed passwords), email addresses, session tokens, and other site configuration data. The confidentiality impact is rated High, while integrity and availability are unaffected by this vulnerability alone. However, extracted credentials could enable follow-on attacks such as account takeover or administrative access, significantly expanding the attack surface (Wordfence, Red Hat).

No public exploit code or active in-the-wild exploitation has been reported as of the available intelligence. The EPSS score is approximately 0.064%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys (detection ID 530768) and is tracked by multiple vulnerability intelligence platforms (Wordfence, Qualys).

1. Reconnaissance: Identify WordPress sites running the Booking Calendar plugin (versions ≤ 10.14.8) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Locate the vulnerable endpoint: Identify the form or API endpoint that accepts the dates_to_check parameter, typically associated with the booking availability check functionality.
3. Craft a time-based blind SQL injection payload: Inject a payload into the dates_to_check parameter that causes a conditional time delay (e.g., using SLEEP() in MySQL) to confirm the injection point is active, without requiring authentication.
4. Enumerate database contents: Use automated tools such as sqlmap with time-based blind technique (--technique=T) to systematically extract database names, table names, and column contents — including the WordPress wp_users table for credentials.
5. Exfiltrate sensitive data: Extract hashed passwords, email addresses, and other sensitive records from the database for offline cracking or further exploitation (Wordfence, WordPress Trac).

• Network: Unusual or repeated HTTP requests to booking-related endpoints containing SQL syntax fragments (e.g., SLEEP, BENCHMARK, AND 1=, OR 1=) in the dates_to_check parameter; abnormally slow server responses suggesting time-delay injection.
• Logs: WordPress or web server access logs showing high volumes of requests to the booking availability endpoint from a single IP or user-agent; requests with URL-encoded SQL keywords in query parameters.
• Process/Database: Elevated database query execution times logged in MySQL slow query logs; unexpected queries involving SLEEP() or BENCHMARK() functions originating from the WordPress application user.

Users should update the Booking Calendar plugin to a version beyond 10.14.8, which includes the fix applied to includes/_capacity/capacity.php (WordPress Trac). As an interim measure, web application firewall (WAF) rules can be configured to block SQL injection patterns in the dates_to_check parameter. Site administrators should also review database access logs for signs of prior exploitation and consider rotating WordPress secret keys and salts if compromise is suspected (Wordfence, Sucuri).

Wordfence, the assigning CNA, published the vulnerability in its threat intelligence database and included it in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Weekly Report). Sucuri highlighted the vulnerability in its December 2025 patch roundup, recommending prompt updates for affected WordPress sites (Sucuri). RedPacket Security also flagged the CVE via social media and its alerting platform shortly after disclosure.