This vulnerability (CVE-2025-39355) in roninwp FAT Services Booking plugin versions up to 5.6 allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patch or remediation information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with low privileges to execute SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability could affect the confidentiality of data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users where possible.