The JetBooking WordPress plugin is vulnerable to SQL Injection through the 'check_in_date' parameter in all versions up to 4.0.3. The vulnerability arises from insufficient input escaping and lack of prepared statements, allowing unauthenticated attackers to append arbitrary SQL code to the existing query. This can be exploited to retrieve sensitive data from the database, such as user credentials, booking details, or other confidential information.

The affected product is the Crocoblock JetBooking plugin for WordPress. All installations running version 4.0.3 or earlier are impacted. No specific build numbers are listed beyond the upper bound of 4.0.3, so any build in that range should be considered vulnerable.

CVSS score 7.5 indicates a high severity with potential data exposure. EPSS score is below 1%, suggesting that exploitation is not currently widespread, and KEV catalog does not list it as a known exploited vulnerability. The attack vector is unauthenticated, so any user with access to the website’s query parameters could trigger the injection, making the risk high for exposed sites. The vulnerability requires no additional privileges, and could be used to extract arbitrary tables or data from the database.