A critical SQL Injection vulnerability has been identified in the WordPress Bookly Plugin. This vulnerability could allow a malicious actor to directly interact with your database, including but not limited to stealing information.
This vulnerability was discovered and responsibly reported by Pablo Sanchez.
The vulnerability is an SQL Injection vulnerability that occurs in the bookly.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious SQL code into the database.
Severity:
The vulnerability has a CVSS 3.1 score of 7.6, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.
Affected Versions:
All versions of the Bookly Plugin prior to 22.4 are affected by this vulnerability.
Impact:
An attacker who successfully exploits this vulnerability could:
- Steal information from your database, such as user information, credit card information, and other sensitive data.
- Modify or delete data in your database.
- Disable your website or database.
- Take complete control of your website and database.
Recommendation:
Due to the gravity of this vulnerability, we strongly advise taking immediate action to protect the WordPress website:
- Update the Plugin: Users of the Bookly Plugin are strongly advised to update to the latest available version (at least 22.4) as soon as possible. This vulnerability has been fixed in version 22.4.
- Regularly Update Plugins: In addition to this specific update, we recommend establishing a regular routine of updating all WordPress plugins and themes to their latest versions. Keeping website components up to date is a fundamental security measure.
- Enhance Security Measures: Consider implementing additional security measures such as web application firewalls (WAFs), robust authentication protocols, and regular security audits. A comprehensive security strategy is pivotal in minimizing the risk of exploitation attempts.
