This vulnerability allows an attacker to inject SQL code into a request handled by the Simply Schedule Appointments plug‑in. The injection is blind, allowing the attacker to infer data from response timing or error messages. Without proper input sanitization, the attacker can read or modify sensitive database contents, compromising confidentiality and integrity of the WordPress site’s data store. The weakness is identified as CWE‑89.

The flaw affects the NSquared Simply Schedule Appointments plug‑in for WordPress, versions from the earliest release through 1.6.9.27.

The CVSS score of 8.5 reflects high severity. EPSS indicates the probability of exploitation is below 1 %, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated or unauthenticated user submitting crafted data to the plugin’s endpoints, though the precise conditions are not detailed in the advisory, so it is inferred.