PT-2025-48009 · WordPress · Bookme – Free Online Appointment Booking/Scheduling Plugin For Wordpress

Sopon Tangpathum · Published 2025-11-25 · Updated 2025-11-25 · CVE-2025-13385

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress versions prior to 4.3

Description The Bookme plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate input sanitization of the filter[status] parameter, allowing authenticated attackers with admin-level access or higher to inject additional SQL queries into existing database queries. This can lead to the extraction of sensitive information from the database.

Recommendations Update Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress to version 4.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13385

Affected Products

Bookme – Free Online Appointment Booking/Scheduling Plugin For Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13385 · Security Note
• https://twitter.com/VulmonFeeds/status/1993289231750332918 · Twitter Post
• https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/trunk/app/admin/Bookings.php#L123 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f2c17222-5de5-4ecd-a7c6-beabe7624c5b?source=cve · Note
• https://t.me/CVEtracker/38172 · Telegram Post
• https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/tags/4.2/app/admin/Bookings.php#L123 · Note
• https://twitter.com/CVEnew/status/1993225819070906780 · Twitter Post