The Course Booking System plugin contains a SQL injection flaw arising from improper neutralization of special characters in SQL commands. This weakness allows an attacker to inject arbitrary SQL, potentially enabling read or modification of the underlying database. Based on the description, it is inferred that an attacker could achieve full database compromise, though the extent depends on plugin usage and database permissions.

All installations of the ComMotion Course Booking System WordPress plugin from the earliest released version through 6.0.6 are affected. Users running any of these releases are vulnerable to exploitation.

With a CVSS score of 9.3 the flaw is classified as critical. The EPSS score of 11% indicates a moderate chance of exploitation. It is not listed in the CISA KEV catalog, implying no known active exploitation. The likely attack vector is unauthenticated remote submission of crafted input via plugin forms or URLs that the plugin processes without proper sanitization.