Improper neutralization of special elements in the SQL command enables a SQL Injection attack, allowing an attacker to inject arbitrary SQL. This flaw can lead to unauthorized data disclosure, modification, or even deletion in the WordPress site database. The vulnerability is classified as CWE‑89 and carries a CVSS score of 7.6, indicating a moderate‑high severity risk to confidentiality and integrity of the stored data.

The setriosoft bizcalendar‑web WordPress plugin versions up through 1.1.0.34 are affected. Any WordPress installation that has installed or is currently using that version of the plugin is susceptible until an upgrade is performed.

The CVSS score of 7.6 reflects a significant ability for an attacker to obtain or alter data. The EPSS score of less than 1% suggests that, as of the latest assessment, exploitation rates are low but not impossible. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is via a web form or URL that the plugin processes without proper sanitization; an attacker can send crafted input to manipulate the database. No explicit authentication requirement is mentioned, so the launch of the attack may be feasible with minimal access, but successful exploitation would still depend on the plugin’s exposure to user input.