The WPBookit plugin for WordPress, developed by Iqonic Design, contains an SQL Injection vulnerability identified as CVE-2024-54280. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing remote attackers to execute arbitrary SQL code without authentication. It affects all versions up to 1.6.0. The CVSS score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact includes high confidentiality loss and low availability impact. No patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the affected WPBookit plugin database, potentially leading to unauthorized access to sensitive information. The confidentiality impact is high, while integrity impact is not indicated, and availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the WPBookit plugin or restricting access to it to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.