The vulnerability arises from improper handling of special characters in SQL commands within the Doctor Appointment Booking plugin. This flaw permits attackers to inject malicious SQL statements, potentially gaining unauthorized read or write access to the WordPress database. Discovery of this weakness could lead to data exfiltration, credential takeover, or complete compromise of the site’s integrity and availability.

All installations of the Creativeitem Doctor Appointment Booking plugin through version 1.0.0 are affected. The plugin is commonly deployed on WordPress sites for scheduling doctor appointments. Sites running any WordPress version that hosts the vulnerable plugin are at risk.

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely exploit the flaw via crafted HTTP requests targeting the plugin’s input fields, which is inferred as the attack vector based on the vulnerability description. This remote, web-based attack could lead to unauthorized database access.