The BookingPress plugin contains a classic SQL Injection flaw classified as CWE-89 that allows an attacker to inject arbitrary SQL commands into the database. This vulnerability arises from improper neutralization of special characters used within an SQL statement, resulting in potential data exfiltration, overwriting, or even deletion of critical information stored by the WordPress site. The impact is limited to the data layer but can have serious ramifications if sensitive user details or financial information are stored.

WordPress sites that have the BookingPress plugin version 1.1.28 or older are affected. The vulnerability was identified in the plugin produced by reputeinfosystems (BookingPress bookingpress-appointment-booking).

The vulnerability scores a CVSS of 7.6, indicating high severity. The EPSS score is below 1%, suggesting that exploitation is unlikely in the current landscape and it is not listed in the CISA KEV catalog. Nonetheless, based on the description it is inferred that the attack vector is through the web application, exploiting inputs accepted by the BookingPress plugin. An attacker would need to craft input containing special characters and submit it via a plugin endpoint to trigger the injection. While the probability of exploitation is low, the potential impact on data confidentiality and integrity remains significant.