Attackers can exploit an unauthenticated SQL Injection flaw in BookingPress Appointment Booking Pro versions up to 6.0.2. By sending specially crafted payloads to the vulnerable plugin endpoints, they can execute arbitrary SQL commands against the WordPress database, leading to unauthorized data exfiltration, modification or potential privilege escalation within the system.

The affected product is the BookingPress Appointment Booking Pro plugin developed by Repute Infosystems, with all releases up to version 6.0.2 susceptible. No additional version qualifiers are provided beyond this upper bound. Systems running WordPress with any of these plugin versions should be reviewed.

Given the high CVSS score of 9.3 and the lack of authentication required, the risk of exploitation is significant. Even though the EPSS score is not available, the absence of a KEV listing suggests current knowledge of exploits is limited, yet the vulnerability remains highly exploitable from the internet via unprotected plugin URLs. Administrators should treat it as a high‑priority remediation.