Description
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin | 1.0.11 – < 1.0.11 | 1.0.11 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Wordpress BookingPress bookingpress_front_get_category_services SQLi
auxiliary/gather/wp_bookingpress_category_services_sqli
GitHub 9 repositories
-
destr4ct/CVE-2022-0739 ★ 12 · Oct 30, 2022
Proof-of-Concept exploit (SQLI BookingPress before 1.0.11)
-
BKreisel/CVE-2022-0739 ★ 11 · Dec 3, 2022
🐍 Python Exploit for CVE-2022-0739
-
viardant/CVE-2022-0739 ★ 4 · Jan 6, 2023
Exploit for WP BookingPress (< 1.0.11) based on destr4ct POC.
-
Chris01s/CVE-2022-0739 ★ 4 · Nov 2, 2022
Simple bash script to automate the exploit of cve 2022 0739
-
Manjen1218/CVE-2022-0739-Exploitation ★ 0 · Oct 8, 2025
-
lhamouche/Bash-exploit-for-CVE-2022-0739 ★ 0 · Mar 19, 2023
-
ElGanz0/CVE-2022-0739 ★ 0 · Feb 18, 2023
BookingPress < 1.0.11 - Unauthenticated SQL Injection
-
G01d3nW01f/CVE-2022-0739 ★ 0 · Dec 23, 2022
-
hadrian3689/wp_bookingpress_1.0.11 ★ 0 · Dec 13, 2022
CVE-2022-0739 Wordpress BookingPress SQLi
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.