CVE-2026-32557

CriticalCVSS 9.3

Published: 06/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

31th percentile - higher than 31% of all known CVEs

Summary

The WooCommerce Appointments plugin (up to version 5.3.2) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.

Risk Assessment

An attacker could extract data from the database, including user and order information, potentially leading to a confidentiality breach.

Recommendation

Update the WooCommerce Appointments plugin to a version later than 5.3.2 that includes the fix for this vulnerability.

Other vulnerabilities in WooCommerce Appointments

CVE-2026-66462High
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments plugin versions up to 5.3.8. An attacker without authentication can access confidential information.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS