This text was generated using artificial intelligence (AI).CVE-2026-32557 affects the WordPress plugin WooCommerce Appointments in versions up to and including 5.3.2. Patchstack classifies the vulnerability as SQL Injection according to CWE-89 with a CVSS score of 9.3. The attack is possible over the network and does not require authentication.
Are my systems affected? Check now →
At a Glance:
| Product / Component | Affected Versions |
|---|---|
| WooCommerce Appointments | <= 5.3.2 |
Patchstack documents CVE-2026-32557 for WooCommerce Appointments up to and including version 5.3.2. The published CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.
The vector describes a network attack with low attack complexity. Neither permissions nor user interaction are required. For prioritization, it is particularly relevant whether WooCommerce Appointments is used on publicly accessible WordPress installations with booking functionality.
The vulnerability affects a specific plugin and a clearly defined version group. The assessment should therefore connect three points: the software used, the version status, and the external accessibility of the associated web application or booking endpoints.
For organizations in Germany and Austria that fall under NIS-2 obligations and operate publicly accessible booking portals, the vulnerability should be classified within the scope of vulnerability management. If unauthorized access to personal data occurs due to exploitation, the reporting obligation according to Art. 33 GDPR applies with a 72-hour deadline to the competent supervisory authority. BSI generally recommends updating WordPress plugins promptly and isolating or disabling vulnerable versions until addressed. In Switzerland, the revised Information Security Act (ISG) applies; reporting obligations for cyberattacks on critical infrastructures are directed to BACS.
Organizations should first determine which WordPress installations are using WooCommerce Appointments. As of 2026-10-06, no official patch from the manufacturer is available, Patchstack recommends their vPatch as a temporary mitigation measure — availability for CVE-2026-32557 should be checked directly on the Patchstack advisory page. This measure does not replace updating the plugin as soon as an official fixed version is released.
A traceable processing sequence includes:
Booking functions can be operated on main domains, regional websites, or other WordPress installations. A simple platform inventory is therefore not sufficient: It is crucial to assess whether the specific plugin is in use, which version is installed, and whether the application is publicly accessible.
Continuous vulnerability and vendor risk monitoring helps track open patch tasks, responsibilities, and documented exceptions beyond individual update processes.
LocateRisk supports external attack surface management for publicly accessible systems and deployed software in external company assets. For CVE-2026-32557, this can help capture external WordPress installations and booking endpoints within one's domain assets and assign them to the responsible teams.
The visibility of an externally accessible service does not automatically indicate a specific vulnerable plugin version. Therefore, verifying the installed version status remains essential for a robust assessment. In environments with externally operated web applications, C-VRM can incorporate technical dependencies and responsibilities into the risk assessment.
LocateRisk is Made in Germany, is operated exclusively in German data centers, and does not process data through U.S. providers.
This affects WooCommerce Appointments in the versions mentioned above. Anyone who wants to know if WooCommerce Appointments is even visible in their externally accessible infrastructure can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-32557 is a critical SQL injection vulnerability (CWE-89) in the WordPress plugin WooCommerce Appointments. It allows attackers to execute SQL commands against the database of the affected WordPress installation over the network without prior authentication. The CVSS-3.1 score is 9.3.
This affects all versions of the plugin up to and including 5.3.2. An official patch from the vendor was not yet available as of October 06, 2026.
Affected installations should be identified and prioritized. As a temporary mitigation measure, Patchstack offers a vPatch for high-risk WordPress vulnerabilities — availability for CVE-2026-32557 should be checked directly on the Patchstack advisory page. Publicly accessible booking endpoints should be monitored closely until fixed or, if possible, temporarily disabled.
Status: October 06, 2026. This contribution is for general informational purposes and does not constitute legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always authoritative. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
English 
Deutsch 
Français