The vulnerability resides in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8. An attacker can send a crafted staff_id parameter in an unauthenticated front‑end booking request. Because the plugin fails to sanitize or cast the parameter before embedding it in an SQL query, the attacker can inject SQL payloads to read arbitrary database tables, including password hashes. The impact is data leakage of sensitive authentication information, potentially allowing credential compromise.

The affected product is the Online Scheduling and Appointment Booking System WordPress plugin for versions earlier than 27.8. Users running any plugin version before the 27.8 release are vulnerable.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger it from the public front‑end without authentication, so the threat is significant for any site that relies on the booking form. Successful exploitation enables extraction of sensitive data such as password hashes from the database, which can lead to broader compromise if passwords are reused.