An improper neutralization of special elements in an SQL command has been identified in the Appointify WordPress plugin. This flaw allows a blind SQL injection, enabling an attacker to retrieve or manipulate data stored in the database by exploiting unsanitized input. The vulnerability is classified as CWE‑89 and can compromise the confidentiality, integrity, or availability of the site’s data.

Affected users are WordPress site operators running the appointify plugin version 1.0.8 or earlier. The plugin is developed by appointify and deployed as a standard WordPress plugin on any site that has not applied the latest updates.

The CVSS score is 7.6, indicating a high severity level. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web interface where untrusted input reaches an SQL query. Exploitation may be possible without authentication, but the details are not explicitly stated in the advisory. Monitoring for time‑based or error‑based SQL response patterns would help detect attempts.