The Bookly appointment scheduling plugin is affected by a critical unauthenticated SQL injection flaw that could allow attackers to gain unauthorized database access.

This is an SQL injection vulnerability (CWE-89) arising from insufficient input sanitization, which can be triggered by unauthenticated users to interact with the database.

The exploitation of this vulnerability allows for unauthorized database queries, which may lead to the disclosure of sensitive booking data, customer information, or administrative credentials. With a CVSS score of 9.3, this flaw is considered critical and requires urgent attention to prevent full database compromise.

Immediate Action: Update the Bookly plugin to version 27.8 or later immediately.

Proactive Monitoring: Monitor database query logs for suspicious or malformed SQL statements and review application logs for unauthorized access attempts.

Compensating Controls: Implement a WAF to filter malicious request parameters that match known SQL injection signatures.

Public Exploit Available: Unknown

The severity of this issue necessitates an immediate update to the latest version of the Bookly plugin. Security teams should prioritize this remediation to ensure that the site remains protected against potential database exploitation attempts.