The Bookster WordPress Appointment Booking Plugin is vulnerable to SQL Injection via the 'raw' parameter due to inadequate escaping and lack of query preparation. This flaw allows authenticated administrators to append malicious SQL fragments to existing queries, potentially extracting or manipulating confidential database information.

All versions of the Bookster plugin up to and including 2.1.1 are affected. The vulnerability is present on WordPress sites that have this plugin installed and where a user with Administrator (or higher) permissions submits a request containing the raw parameter.

With a CVSS score of 4.9 the vulnerability is considered medium severity, and an EPSS score of less than 1% indicates a low likelihood of exploitation as of now. It is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented. Exploitation requires authenticated access to the WordPress dashboard; the attacker must craft a request that injects SQL through the raw parameter, which, if successful, can read sensitive data.