The WP Booking System – Booking Calendar plugin for WordPress suffers from a generic SQL injection flaw (CWE-89) in the ‘data[orderby]’ parameter that is only processed when the AJAX handler follows the use_ajax branch. An attacker with administrator privileges can craft a malicious value that is not properly escaped and is concatenated directly into an existing SQL query, allowing the attacker to append and execute arbitrary SQL statements. The exploit requires that the targeted calendar contain more than 200 bookings, a condition that an administrator can satisfy by creating bookings before triggering the vulnerable request. The primary impact is the potential extraction of sensitive database information such as user data, booking details, and configuration settings.

The affected vendor is murgroland and the product is the WP Booking System – Booking Calendar plugin. All releases up to and including version 2.1.0.1 are confirmed to be vulnerable. No information in the supplied data indicates that a later release contains a fix, so sites running 2.1.0.1 or earlier remain at risk.

The CVSS score of 4.9 marks this vulnerability as moderate, and the EPSS score of less than 1 % denotes a very low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog, meaning no known active exploits have been reported. However, because the flaw requires administrator privileges, the attack surface is limited to sites where an admin credential has been compromised or is otherwise insecure.