This vulnerability arises from improper neutralization of special elements in an SQL command, allowing an attacker to inject arbitrary SQL. The impact is the ability to read, modify, or delete data stored within the WordPress database, potentially compromising customer information and booking records. The weakness is identified as CWE-89, a classic SQL injection scenario.

The flaw affects the Solidres – Hotel booking plugin for WordPress with all releases up to and including version 0.9.4. Users running any of these versions are exposed; the vendor product is Solidres, a popular booking solution within WordPress instances.

The CVSS score of 8.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector would involve a malicious user crafting input that reaches the plugin’s database query logic, inferred from the nature of SQL injection. Even without active exploitation, the possibility of unauthorized data access remains high if the plugin remains unpatched.