An SQL injection flaw in the WordPress BMA Lite plugin allows attackers to supply specially crafted input that bypasses proper sanitization and is executed by the underlying database. The vulnerability arises from improper neutralization of special elements in SQL commands, enabling the injection of arbitrary SQL statements. Successful exploitation could give an attacker read or write access to the database, potentially leading to the disclosure of sensitive data or alteration of application behavior.

The flaw is present in all releases of the BMA Lite plugin from RedefiningTheWeb up to and including version 1.4.2. WordPress sites that have this plugin installed and have not applied a newer version are vulnerable.

The CVSS v3.1 score of 7.6 signals a high severity, while the EPSS score of less than 1 % suggests that exploitation likelihood is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely target the plugin through its public‑facing booking interface, sending crafted parameters that are reflected in dynamic SQL statements. The exploit does not require authentication, meaning anyone with internet access to the site could trigger it.