This vulnerability in roninwp FAT Services Booking plugin (<= 5.6) is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. An attacker can exploit this remotely without authentication or user interaction, potentially compromising confidentiality of the database. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges or user interaction needed, and high confidentiality impact with limited integrity and availability impact.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information. The CVSS score reflects a critical confidentiality impact with limited integrity and availability impact. No known exploits are reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor official roninwp channels for updates and apply any official fixes promptly once released.