The Bookly plugin for WordPress is vulnerable to a time‑based SQL injection attack that allows unauthenticated actors to inject arbitrary SQL through the staff_ids parameter. Because the application fails to escape user input and does not use parameterized queries, malicious payloads are appended to legitimate queries. As a result, attackers can read or modify database contents, exposing sensitive user and scheduling data.

WordPress sites running the Bookly scheduling and appointment booking plugin, version 27.5 or earlier, distributed by ladela.

The vulnerability carries a CVSS score of 7.5 and an EPSS score below 1 %, indicating low current exploitation frequency. The two‑request exploit chain requires an initial request to bookly_get_form_id to seed a booking session, followed by a request to bookly_render_time that propagates the malicious staff_ids array. CSRF/nonce protection is missing on both endpoints, enabling a cross‑site request forgery attack that can be launched from a distant site. While the exploit is not trivial, the combination of unauthenticated access and lack of input sanitization makes it accessible to attackers who can write simple scripts or leverage existing web‑application‑attack frameworks.