The vulnerability is a blind SQL injection that permits attackers to append arbitrary SQL fragments to database queries. It originates from the TD_DB_Model component, where the append_where_sql parameter received via JSON request bodies is forwarded to MySQL without proper sanitization, while Only its presence in the $_REQUEST superglobal is checked. This flaw, identified as CWE‑89, enables unauthenticated attackers to retrieve sensitive content from the database if they possess a valid public_token that may be inadvertently exposed during the booking flow. The resulting impact includes potential confidentiality breaches and possible integrity violations if malicious commands are executed.

All installations of the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin with version 1.6.9.27 or earlier are affected. The issue resides in the plugin’s backend database abstraction layer and is present in any WordPress site that has this plugin active prior to the stated release. No information indicates that later releases have fixed the flaw, so sites running the affected version range remain at risk.

The CVSS v3.1 score of 7.5 classifies the vulnerability as High severity. The EPSS score of <1 % suggests that exploitation likelihood is currently low, and the flaw is not listed in the CISA KEV catalog. Attackers require access to a public_token, obtainable during normal booking interactions, and the ability to send a crafted JSON payload to the plugin’s endpoint. Because the vulnerability is unauthenticated, broad target coverage exists, but the commercial popularity of the plugin and the specific requirement for a publicly exposed token reduce the immediate exploitation probability.