The Booking Calendar WordPress plugin is vulnerable to a time‑based blind SQL Injection through the dates_to_check parameter. The attacker can insert additional SQL statements into the existing query because user input is not properly escaped, allowing extraction of sensitive database contents. The primarily affected data is the site database, and no direct system compromise or code execution is described in the advisory, but unauthorized read access to confidential information is possible.

Any WordPress website that has the Booking Calendar plugin installed, specifically versions 10.14.8 and all earlier releases from the wpdevelop developers. The vulnerability exists in every installation that has not upgraded beyond 10.14.8.

The severity of the flaw is reflected in a CVSS score of 7.5. The EPSS score is below 1 %, indicating that while exploitation is likely low probability, the vulnerability is still dangerous. The vulnerability has not been listed in the CISA KEV catalog. The attack vector is remote, unauthenticated, and requires the attacker to send a crafted HTTP request to the plugin’s endpoint that accepts the dates_to_check parameter. Once in, the attacker can construct time‑based payloads to confirm and retrieve data from the database.