CVE-2024-2341 is an SQL Injection vulnerability (CWE-89) in the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, affecting all versions up to 1.6.7.7. The issue stems from improper neutralization of special elements in the 'keys' parameter, allowing authenticated users with subscriber or higher privileges to inject additional SQL queries. This can lead to unauthorized disclosure of sensitive data from the backend database. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required beyond authentication.

Exploitation of this vulnerability allows an authenticated attacker with subscriber-level access or higher to perform SQL Injection attacks, potentially leading to unauthorized disclosure, modification, or deletion of sensitive data stored in the plugin's database tables. The impact includes confidentiality, integrity, and availability violations as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the plugin. Avoid using affected versions of the plugin in sensitive environments. Follow vendor channels for updates regarding patches or official mitigations.