The flaw is an uncontrolled SQL injection in the WooCommerce Appointments plugin versions up to 5.3.2. An attacker can supply malicious SQL through a publicly accessible plugin endpoint that does not require authentication, allowing the execution of any SQL statement. This can lead to reading sensitive data, modifying or deleting records, and in extreme cases may expose privilege escalation or web application compromise.

WordPress sites running WooCommerce Appointments version 5.3.2 or earlier. The vulnerability is independent of user roles; any visitor to the affected site can exploit it if the plugin is active.

The flaw carries a CVSS score of 9.3, indicating critical severity. The EPSS score is < 1% (0.00383), but the high CVSS combined with the lack of authentication requirement means the exploitability is high for publicly reachable sites. The vulnerability is not listed in the CISA KEV catalog, yet the lack of authentication and potential for arbitrary SQL execution make it a top priority to remediate.