CVE-2026-14516

The Bookly plugin for WordPress has a vulnerability in versions up to 27.5 that allows an attacker to inject malicious SQL code into the system. This occurs because the plugin does not properly sanitize user input in the 'staff_ids' parameter, allowing an attacker to inject additional SQL queries. An attacker can exploit this vulnerability by first creating a booking session with malicious 'staff_ids' values, and then triggering a specific action that causes the tainted data to be used in a vulnerable query. This can be done without authentication and even from a different website, making it a potentially serious security risk.

Based on public CVE data (MITRE/NVD).