The booking plugin contains a time‑based blind SQL injection that allows unauthenticated attackers to append arbitrary SQL through the ‘append_where_sql’ parameter. By injecting crafted statements, an attacker can read, modify, or delete database contents, potentially compromising the entire WordPress site. The weakness is a classic injection flaw that directly harms confidentiality and integrity.

Croixhaug’s "Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin" is affected in all releases up to and including 1.6.11.8. Users running these versions, whether on public or internal sites, are vulnerable.

The CVSS score of 7.5 indicates a high‑severity flaw, and while EPSS data is unavailable, the public nonce embedded in the widget makes the REST endpoint reachable to any visitor. The attack requires only a crafted PUT request with an application/x‑www‑form‑urlencoded body, bypassing the blocklist check. The plugin is not listed in KEV, yet any site deploying the vulnerable version faces significant risk of data exposure or unauthorized database manipulation.