CVE-2024-10540 is an SQL Injection vulnerability in the Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress for WordPress. It occurs via the 'service' parameter in the bookingpress_form shortcode due to improper neutralization of special elements in SQL commands. Authenticated attackers with at least Subscriber privileges can inject additional SQL queries because of insufficient escaping and lack of prepared statements in the affected plugin versions up to 1.1.16. This vulnerability allows unauthorized extraction of sensitive information from the database. The CVSS 3.1 base score is 5.3, reflecting medium severity with network attack vector, high attack complexity, and low privileges required.

An attacker with Subscriber-level access or higher can exploit this vulnerability to perform SQL Injection attacks, enabling them to extract sensitive information from the backend database. The vulnerability does not directly allow data modification or denial of service but compromises confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities where possible and monitor for unusual database activity related to the bookingpress_form shortcode. Avoid using affected plugin versions in sensitive environments.