The vulnerability is a classic SQL injection flaw in the Booking Manager WordPress plugin, present in all releases before 2.1.21. It arises because the plugin does not properly sanitize or escape data obtained from a fetched iCalendar feed before incorporating it into a SQL query. An attacker who has access to the site with Author-level permissions or higher can supply a crafted feed URL and execute arbitrary SQL statements, potentially leaking, modifying, or deleting data stored in the WordPress database.

The affected product is the Booking Manager plugin for WordPress, with all versions earlier than 2.1.21. The plugin does not have a publisher identifier listed in the CNA data; it is widely available in the WordPress ecosystem. All installations using older releases are susceptible.

The CVSS score of 6.8 places this flaw in the medium rating range, reflecting the need for authenticated access and limited attacker expertise. The EPSS score is below 1 %, indicating that, while the flaw is exploitable, it is not widely seen in the current threat landscape. The vulnerability is not yet catalogued in the CISA Known Exploited Vulnerabilities (KEV) list. The most likely attack vector is an authenticated user with Author privileges manually importing a malicious iCalendar feed. Once the feed is processed, the injected SQL can read, modify, or delete database tables, compromising data integrity and confidentiality.