The Booking Package plugin for WordPress contains a generic SQL injection flaw that is triggered by the 'email' form parameter in the /wp-json/booking-package/v1/request REST endpoint. The parameter is passed to the database without escaping or prepared statements, and the endpoint’s permission callback is __return_true, meaning no authentication is required for access. As a result, an attacker can inject arbitrary SQL commands that reach the database layer, potentially allowing extraction of sensitive data; however, the impact is severely limited as the vulnerable parameter is used only within the is_email context, restricting the scope of damage. The weakness is classified as CWE‑89.

WordPress sites running Booking Package version 1.7.20 or earlier are affected. The vulnerability exists in all installations that have not upgraded beyond that release.

The base CVSS score is 7.5, indicating a high severity. Its EPSS score is below 1 %, showing a low current exploitation probability, and it is not cataloged in the CISA KEV list. The vulnerability can be exploited over the network via an unauthenticated HTTP POST to the open REST endpoint; the payload must include an unescaped 'email' field, but no prior authentication or privileged access is required.