CVE-2025-12166
Published: 14 January 2026
Summary
CVE-2025-12166 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12166 is a blind SQL injection vulnerability in the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, affecting all versions up to and including 1.6.9.9. The issue stems from insufficient escaping of the user-supplied `order` and `append_where_sql` parameters combined with a lack of sufficient preparation in the existing SQL query, allowing injection of malicious SQL.
Unauthenticated attackers can exploit this vulnerability over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N) in an unchanged scope (S:U). Exploitation enables appending additional SQL queries to extract sensitive information from the database, resulting in high confidentiality impact (C:H) with no integrity (I:N) or availability (A:N) disruption, as scored at 7.5 under CVSS:3.1.
Advisories reference mitigation via a patch in WordPress plugin changeset 3408539 at https://plugins.trac.wordpress.org/changeset/3408539/. Further details on the vulnerability are available in Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/5214a399-21a4-4573-9840-1d5043781bc0?source=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2839
Vulnerability details
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` parameters in all versions up to, and including, 1.6.9.9 due to insufficient escaping on the user…
more
supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Blind SQL injection in public-facing WordPress plugin directly enables remote exploitation of a web application for database data extraction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of user-supplied parameters like 'order' and 'append_where_sql' to prevent blind SQL injection by ensuring sufficient escaping and preparation.
Mandates timely flaw remediation through patching, such as the WordPress plugin update in changeset 3408539, to fix the SQL injection vulnerability.
Vulnerability scanning identifies SQL injection flaws like CVE-2025-12166 in WordPress plugins for proactive remediation.