CVE-2026-73365: WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability
Published Aug 18, 2026
·Updated
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
Affected Software
1 affected component
WordPress JetAppointment plugin<=2.5.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetAppointment pluginto a version that resolves this vulnerability.Fixed in 2.5.2.1
Event History
Aug 18, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
WordPress sites using the JetAppointment plugin at version 2.5.2 or earlier are affected according to the available data. The vulnerability is reachable over the network and does not require authentication or user interaction.
2
What does an attacker need to exploit this vulnerability?
An attacker does not need an account, privileges, or user interaction to exploit the issue. The CVSS vector indicates low attack complexity and potential high confidentiality impact, with a low availability impact.