The flaw is a classic SQL injection that allows an attacker to inject arbitrary SQL into commands processed by the Hydra Booking plugin. The lack of proper neutralization of special characters means that an unauthenticated or privileged attacker could read, modify, or delete records in the WordPress database. The vulnerability sits under CWE‑89 and carries a high severity score indicating significant risk.

The affected plugin is Themefic Hydra Booking for WordPress, specifically all releases up to and including version 1.1.32. The issue does not affect newer releases once the vendor releases a fix. The problem is present across all installations of the plugin before the stated version limit.

With a CVSS score of 8.5 the vulnerability is considered high. The EPSS score of less than 1% suggests that exploitation is currently rare, and it is not yet listed in the CISA KEV catalog. The likely attack vector is through the web interface where the plugin processes user-supplied data. An attacker with sufficient access to the site could use it to exfiltrate data or compromise the underlying database.