The JetAppointment plugin for WordPress, versions up to 2.5.2, contains an unauthenticated SQL injection flaw that permits attackers to send malicious SQL through input fields without needing authentication. The flaw arises from improper sanitization of user‑supplied data before incorporating it into database queries, which is a classic injection weakness identified as CWE‑89. An attacker exploiting this vulnerability can read, modify or delete arbitrary rows in the WordPress database, potentially exposing sensitive user information, corrupting appointment data, or creating a foothold for further attacks such as remote code execution or privilege escalation on the host.

Affected products are the JetAppointment plugin distributed by Crocoblock and Jetimpex Inc. The issue manifests in all installations of JetAppointment 2.5.2 or earlier. There is no version information granularly listed beyond the <= 2.5.2 cutoff, so any deployment using a version at or below that threshold is vulnerable.

The review assigns a CVSS score of 9.3, indicating critical severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, yet the lack of authentication requirements means that any web visitor can trigger the exploit. Attackers can extract or corrupt data with minimal effort, and given the high CVSS, the potential impact is substantial. Immediate remediation is recommended because the opportunity remains open until a patch is applied.