The Booking Calendar plugin for WordPress has a flaw that causes improper neutralization of special elements in SQL commands, enabling blind SQL injection. The vulnerability is classified as CWE‑89 and permits an attacker to send crafted requests that trick the application into executing arbitrary SQL statements against the site's database, potentially exposing sensitive data or modifying or deleting records.

WordPress sites that use the wpdevelop Booking Calendar plugin version 10.14.15 or earlier are affected. The issue applies to any installation of the plugin with a version up to and including 10.14.15, as indicated by the vendor impact statement.

The CVSS base score of 7.6 indicates a high severity impact, while the EPSS score of less than 1% suggests a low current likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, requiring access to publicly exposed booking pages or API endpoints that accept user input. Exploitation would involve sending multiple crafted requests to infer database schema or data through timing or result-based responses, granting the attacker unauthorized access to the database content and the potential to alter or delete stored data.