The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'fields' parameter in all versions up to 1.6.10.0. The vulnerability arises from insufficient escaping of user‑supplied input and the absence of prepared statements in the existing SQL query. This flaw allows attackers to append arbitrary SQL commands, enabling the extraction of sensitive data such as usernames, email addresses, and password hashes from the database. The weakness is identified as CWE-89, indicating a classic SQL injection scenario.

All installations of the Appointment Booking Calendar plugin version 1.6.10.0 or earlier are affected. The plugin is distributed under the brand croixhaug:Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin. No specific vendor patch notes are available in the supplied data; the fix is presumed to be included in any release newer than 1.6.10.0.

The CVSS Base Score for this issue is 7.5, indicating high severity. EPSS data is not available, so the current exploitation probability is uncertain, but the flaw is known to be exploitable by unauthenticated users. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a crafted request to the 'fields' parameter, causing the plugin to execute injected SQL statements.