Improper neutralization of special elements in the SQL command used by the Booking Calendar and Notification plugin allows an attacker to perform blind SQL injection. This flaw can enable execution of arbitrary queries against the plugin’s database, potentially exposing, altering, or destroying data stored by the plugin.

WordPress sites that use the shiptrack Booking Calendar and Notification plugin, any version up through 4.0.3, are affected. The plugin is distributed as a WordPress plugin and is installed on the site’s web server, so anyone able to reach the plugin’s entry points could exploit it.

The CVSS score of 9.3 indicates critical severity, but the EPSS score of less than 1% suggests that, at present, real‑world exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a web request to the plugin’s endpoints, meaning remote attackers could trigger the blind injection without authentication if the plugin does not enforce proper access control.