An improper neutralization of special elements in an SQL command allows attackers to inject arbitrary SQL statements into the Bus Ticket Booking with Seat Reservation for WooCommerce plugin. This flaw can enable data exfiltration, modification, or deletion, and depending on the database configuration, may lead to escalation of privileges or execution of additional malicious code. The weakness is a classic SQL Injection (CWE-89) and carries the potential to undermine the confidentiality, integrity, and availability of the underlying data store.

The affected plugin is Bus Ticket Booking with Seat Reservation for WooCommerce by smartcms, versions from the earliest release up to and including 1.7. No specific revision numbers are listed, but all releases 1.7 and earlier are vulnerable.

The vulnerability carries a CVSS score of 9.3, indicating critical severity, while the EPSS score is below 1%, suggesting low probability of detection or widespread exploitation currently. It is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw remotely by sending crafted requests to the plugin’s endpoints; authentication requirements are not specified, so both authenticated and unauthenticated scenarios are possible. The lack of immediate exploitation evidence means the risk is contingent on the opportunity to discover the vulnerable endpoints.