The WP BASE Booking plugin contains an improper neutralization of special elements used in an SQL command, also known as a blind SQL injection flaw. This weakness (CWE-89) permits an attacker to send crafted input that is embedded directly into database queries. If exploited, the attacker could read, modify, or delete sensitive database records, potentially exposing customer data or altering booking information. The impact is a compromise of data confidentiality, integrity, and availability of the booking system.

The vulnerability affects the WP BASE Booking plug‑in for WordPress. All releases up to and including version 6.4.0 are potentially vulnerable. The vendor offers a fix in version 6.5.0, and earlier versions are no longer supported. The plugin is intended for WordPress sites that manage appointments, services, and events.

The CVSS base score of 9.3 indicates a high‑severity flaw. No EPSS score publicly available, making the precise exploitation likelihood unclear, but the lack of a KEV listing suggests no widespread exploitation known at this time. The attack vector is inferred to be web‑based, requiring the attacker to supply malicious input to the plugin’s API endpoints. Because the injection is blind, the attacker would need to infer results through timing or false error messages, but successful exploitation would still allow privileged database access. Given the high CVSS rating, administrators should treat this as a critical risk.