WooCommerce Appointments: Unauthenticated blind SQL injection (CVE-2026-32557)
Summary
The WooCommerce Appointments plugin for WordPress up to and including version 5.3.2 contains a blind SQL injection vulnerability. An unauthenticated remote attacker can send crafted requests to the site to manipulate database queries, potentially reading, modifying or deleting database content such as customer details, booking records and account data. The CVSS score is 9.3 (critical), and Patchstack rates the issue as high priority.
Affected
- WooCommerce Appointments (BookingWP) versions up to and including 5.3.2
- Exploitation requires no login and no user interaction over the network
Fixed in
- Unknown. No vendor-confirmed fixed version was found in the sources.
- Do not assume a later version is safe; verify the current release against the BookingWP changelog.
Workaround
- No vendor workaround found.
- Disable the plugin or the booking pages until a fix is verified, where feasible.
- Restrict booking endpoints to known IP addresses, where feasible.
- Use a web application firewall with rules tuned to the site's traffic.
Exploitation
- Patchstack states the vulnerability is expected to be exploited and is used in mass-exploit campaigns, but lists it as not known to be exploited (KEV: No per Strix and HOL).
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found; EPSS not available.
Our recommendation
- Check whether WooCommerce Appointments is installed and which version is active.
- If installed, disable the plugin or booking pages until the vendor confirms a fix for this CVE.
- Apply the vendor fix as soon as it is confirmed and tested.
- Put a web application firewall in front of the site and review logs for unusual requests to booking endpoints.
- Review database user privileges (least privilege) and take a current backup before changes.
- If compromise is suspected, rotate WordPress and WooCommerce credentials and assess personal data impact under the nFADP.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Strix CVE-2026-32557 www.strix.ai
- HOL Guard CVE-2026-32557 hol.org
- GitHub issue bookingwp/woocommerce-appointments #1469 github.com
- BookingWP WooCommerce Appointments product page bookingwp.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:22.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.