The plugin contains a blind SQL injection vulnerability that allows unauthenticated attackers to supply malicious input through the `order` and `append_where_sql` parameters. By inserting crafted SQL fragments, an attacker can append additional statements to the existing query and extract data from the database. The nature of the flaw is a classic SQL injection (CWE‑89) and does not enable remote code execution, but it can compromise the confidentiality of sensitive site information.

The vulnerability affects the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin from croixhaug. All released versions up to and including 1.6.9.9 are impacted. Users who rely on this plugin for booking functionality must check their current installations against this version range.

The CVSS score of 7.5 indicates a high impact severity, while the EPSS score of less than 1% shows that exploit attempts are unlikely in the current environment. The plugin is listed as not in the CISA KEV catalog, and the vulnerability is exploitable via unauthenticated HTTP requests to the WordPress site. Because no privileged access is required, the risk to sites that expose the plugin’s endpoints remains high for attackers that map the affected URLs.