Weapons of choice are embedded SQL statements that allow an attacker to inject malicious queries through the "category_id" parameter. The vulnerability stems from insufficient escaping and lack of query preparation, and it falls under CWE‑89. As a result, an unauthenticated user could append additional SQL commands to legitimate queries, enabling exfiltration of content from the database.

The affected plugin is GravityMore's Gravity Bookings, a WordPress add‑on, in all releases up to and including version 2.5.9. Systems running WordPress with this plugin installed and not updated to a newer version are susceptible.

The CVSS score of 7.5 classifies this flaw as high severity. The EPSS score is not provided, so the current likelihood of exploitation is unclear. It is not cataloged in the CISA KEV list. Exploitation path requires no authentication; an attacker can simply craft a request to the "category_id" endpoint and inject payloads that are executed within the WordPress database context.