The vulnerability is an improper neutralization of special elements used in an SQL command, allowing blind SQL injection in the Bob Hostel WordPress plugin. An attacker that supplies crafted input can cause the plugin to execute arbitrary SQL statements, potentially extracting sensitive data from the database or modifying it without direct error messages. The weakness is classified as CWE-89, indicating that the input is incorporated into SQL commands without proper sanitization, leading to confidentiality and integrity risks.

This flaw affects the Bob Hostel plugin, named Hostel, in all versions up to and including 1.1.5.6. Users who have installed any of those releases on a WordPress site are potentially vulnerable until the plugin is updated to a version that removes the unparameterized SQL call.

The CVSS score of 7.6 signals a high severity. The EPSS score of less than 1% indicates that current evidence of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Although the attack is blind, an adversary can send crafted HTTP requests to the plugin’s public endpoints, observe timing or side‑channel differences, and iteratively infer data. The likely attack vector is through the web interface of the plugin, requiring no privileged server access.