Unauthenticated SQL Injection has been discovered in the WordPress Bookly plugin versions 27.7 and earlier, allowing an attacker to embed arbitrary SQL commands into crafted requests that are then executed directly against the WordPress database. The flaw is caused by unsanitized data being interpolated into database queries, a weakness formally classified as CWE‑89. This vulnerability permits an attacker to read, modify, or delete database contents, potentially exposing sensitive user information, business logic, or configuration data. The vulnerability description does not confirm the possibility of remote code execution, so any such impact is not guaranteed by the provided data.

The Bookly responsive appointment booking tool for WordPress is affected when installed at version 27.7 or lower; installations of 27.8 and later include the fix and are not impacted. No other plugins or versions are listed as vulnerable.

The CVSS score of 9.3 marks this flaw as critical and indicates an unauthenticated attack vector with high impact. The EPSS score of less than 1% suggests a low but non‑zero current exploitation probability. Because the flaw is not listed in the CISA KEV catalog, there is no indication of known, active exploitation in the wild. An attacker can exploit the vulnerability by sending a crafted HTTP request to the vulnerable endpoint; no credentials or authentication are required. Successful exploitation would grant the attacker the ability to retrieve, alter, or delete data stored in the WordPress database, representing a serious data integrity and confidentiality threat.