The Pinpoint Booking System WordPress plugin versions up to 2.9.9.5.4 are vulnerable to SQL Injection via the 'language' parameter due to improper neutralization of special elements in SQL commands. Authenticated attackers with Subscriber-level access or above can exploit this flaw to append malicious SQL queries to existing ones, potentially extracting sensitive data from the backend database. The vulnerability is tracked as CVE-2024-13235 with a CVSS 3.1 base score of 6.5, indicating a medium severity risk. No vendor advisory or patch links are provided, and the plugin is not a cloud service, so remediation depends on plugin updates from the vendor.

Exploitation allows authenticated users with low privileges (Subscriber-level and above) to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information from the database. There is no indication of data modification or denial of service impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and consider disabling or removing the plugin if possible. Monitor for vendor updates and apply patches promptly once available.