PT-2026-54630 · WordPress · Motopress Appointment Booking

Matilj · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-13454

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MotoPress Appointment Booking versions prior to 2.4.6

Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with the mpa appointment employee custom role to perform SQL Injection. By manipulating the s parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to version 2.4.6 or later. Restrict access to the mpa appointment employee role to trusted users only.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-13454

Affected Products

Motopress Appointment Booking

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-13454 · Security Note
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.5/includes/admin-pages/manage/ManageBookingsPage.php#L247 · Note
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.5/includes/admin-pages/manage/ManageBookingsPage.php#L310 · Note
• https://twitter.com/VulmonFeeds/status/2072304244581941416 · Twitter Post
• https://t.me/cveNotify/182239 · Telegram Post
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/admin-pages/manage/ManageBookingsPage.php#L310 · Note
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/admin-pages/manage/ManageBookingsPage.php#L247 · Note
• https://t.me/CVEtracker/58562 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/64e4d51a-7b65-4fba-9742-bc7d23f46f8d?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3591693/motopress-appointment-lite/trunk/includes/admin-pages/manage/ManageBookingsPage.php · Note
• https://t.me/cveNotify/182197 · Telegram Post