CVE-2025-13385

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13385", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T21:01:51.304Z", "datePublished": "2025-11-25T07:28:27.424Z", "dateUpdated": "2026-04-08T17:32:40.991Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:40.991Z"}, "affected": [{"vendor": "bylancer", "product": "Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c17222-5de5-4ecd-a7c6-beabe7624c5b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/tags/4.2/app/admin/Bookings.php#L123"}, {"url": "https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/trunk/app/admin/Bookings.php#L123"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sopon Tangpathum (SoNaJaa)"}], "timeline": [{"time": "2025-11-24T19:08:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T14:24:52.788575Z", "id": "CVE-2025-13385", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:25:39.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13385", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-25T14:24:52.788575Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:24:59.734Z"}}], "cna": {"title": "Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Sopon Tangpathum (SoNaJaa)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "bylancer", "product": "Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-24T19:08:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c17222-5de5-4ecd-a7c6-beabe7624c5b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/tags/4.2/app/admin/Bookings.php#L123"}, {"url": "https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/trunk/app/admin/Bookings.php#L123"}], "descriptions": [{"lang": "en", "value": "The Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:40.991Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13385", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:40.991Z", "dateReserved": "2025-11-18T21:01:51.304Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-25T07:28:27.424Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin", "vendor": "bylancer", "versions": [{"lessThanOrEqual": "4.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Bookme - Reserva y Programaci\u00f3n de Citas en L\u00ednea Gratuito para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 'filter[status]' en todas las versiones hasta la 4.2, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador y superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-13385", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13385", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T14:24:52.788575Z", "version": "2.0.3"}}]}, "published": "2025-11-25T08:15:50.630", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/tags/4.2/app/admin/Bookings.php#L123"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/trunk/app/admin/Bookings.php#L123"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c17222-5de5-4ecd-a7c6-beabe7624c5b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:18:18.030358+00:00", "value": {"mitigation_remediation": ["Upgrade the Bookme plugin to the latest available version (greater than 4.2).", "Limit WordPress administrator roles to trusted users only and block the filter[status] endpoint for non\u2011admin roles where possible.", "Sanitize the filter[status] parameter on the server side, ensuring it matches only allowed status codes before being incorporated into the SQL query."], "summary": {"action": "Update plugin", "impact": "Data extraction via SQL injection"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the bylancer Bookme plugin in any version 4.2 or older. The vulnerable code resides in the admin/Bookings.php file accessed by users with admin or higher roles.", "description_and_impact": "The Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin is vulnerable to a time\u2011based SQL injection through the filter[status] parameter in all releases up to and including 4.2. The issue stems from insufficient escaping of a user\u2011supplied value and the lack of prepared statements, allowing authenticated users with administrator or higher privileges to append additional SQL statements to existing queries. This can be used to read sensitive data such as user credentials, booking details, and other private information stored in the database.", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than 1\u2009% suggests a low likelihood of exploitation in the wild. The vulnerability is not currently listed in CISA\u2019s KEV catalog. Exploitation requires authentic access with administrator privileges, so an attacker would first need to compromise an admin account or use social engineering to gain such access before injecting malicious SQL via the filter[status] input."}}}}, "created": "2025-11-26T11:11:01.536994+00:00", "updated": "2026-04-21T01:30:24.386813+00:00", "vendors": ["bylancer", "bylancer$PRODUCT$bookme", "wordpress", "wordpress$PRODUCT$wordpress"]}