The Bookme – Free Online Appointment Booking and Scheduling Plugin is vulnerable to a time‑based SQL injection through the filter[status] parameter in all releases up to and including 4.2. The issue stems from insufficient escaping of a user‑supplied value and the lack of prepared statements, allowing authenticated users with administrator or higher privileges to append additional SQL statements to existing queries. This can be used to read sensitive data such as user credentials, booking details, and other private information stored in the database.

WordPress sites that have installed the bylancer Bookme plugin in any version 4.2 or older. The vulnerable code resides in the admin/Bookings.php file accessed by users with admin or higher roles.

The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires authentic access with administrator privileges, so an attacker would first need to compromise an admin account or use social engineering to gain such access before injecting malicious SQL via the filter[status] input.