CVE-2026-61949

An unauthenticated SQL injection vulnerability in Bookly versions up to 27.7 allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data and complete database compromise. Organizations using affected versions should prioritize patching this critical vulnerability to mitigate the risk of data breaches and maintain the integrity of their systems. Immediate action is essential for any entity relying on Bookly for managing bookings or customer data.