CVE-2024-1207 is a critical SQL Injection vulnerability in the WP Booking Calendar plugin for WordPress, affecting all versions up to and including 9.9. The vulnerability arises from improper neutralization of special elements in the 'calendar_request_params[dates_ddmmyy_csv]' parameter, allowing unauthenticated attackers to append malicious SQL queries. This occurs because the plugin fails to sufficiently escape user input and does not use prepared statements for the affected SQL queries. The flaw enables attackers to extract or manipulate sensitive database information without authentication.

Successful exploitation of this vulnerability can lead to full compromise of the plugin's underlying database, including unauthorized disclosure, modification, or deletion of data. Given the unauthenticated nature of the attack vector and the high CVSS score (9.8), the impact is critical, potentially affecting confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or trusted security sources is strongly recommended.