This issue arises from improper neutralization of special elements used within an SQL command in the Amelia booking plugin. The vulnerable code processes user input without adequate escaping, enabling attackers to embed SQL fragments that are blindly executed by the database. The resulting blind SQL injection can allow an attacker to read, modify, or delete data, possibly leading to compromised site integrity and confidentiality.

WordPress sites deployed with the Amelia booking plugin version 2.1.1 or earlier are vulnerable. Only the plugin layer is affected; the core WordPress installation itself is not directly impacted unless it relies on the plugin for critical functions.

The CVSS score of 7.6 signifies a high severity risk, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA known exploited vulnerabilities catalog. Likely attack vectors are through any plugin form or API endpoint that accepts unchecked user input, with the attacker needing to infer the database response via blind techniques.