The vulnerability in the codepeople Appointment Booking Calendar plugin for WordPress allows an attacker to exploit a missing Cross‑Site Request Forgery (CSRF) check and inject malicious SQL statements. This flaw permits an attacker to perform unintended database operations—potentially reading, modifying, or deleting booking data—when triggered by a crafted request from a victim’s authenticated browser. The weakness falls under CWE‑352, indicating that the plugin does not properly verify that state‑changing requests are intentionally initiated by the user.

Any WordPress site running codepeople’s Appointment Booking Calendar plugin up to and including version 1.3.92 is affected. The problem does not exist in versions newer than 1.3.92, but sites that have not yet updated remain vulnerable.

With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score of less than 1% suggests that automated exploitation is currently unlikely, and it is not listed in CISA KEV. However, the attack vector is a CSRF‑based web request, meaning that a socially engineered or compromised site can forward a malicious request on behalf of an authenticated user. An attacker can therefore achieve SQL injection through normal web traffic if the victim accepts the crafted request.