Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96662 · Microsoft / collected KEV context

cve-program · CVE-2026-96662

• https://www.wordfence.com/threat-intel/vulnerabilities/id/18c1a5a0-dee0-45ee-9e8b-0937b392eccd?source=cve
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/models/model.php#L403
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/connector_helper.php#L212
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1825
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1231
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L356
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L22
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/latepoint.php#L1072
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3718438%40latepoint&new=3718438%40latepoint

No related operational record is retained in the current change model.