CVE-2025-8781 is an SQL Injection vulnerability in the Bookster WordPress Appointment Booking Plugin affecting all versions up to 2.1.1. The issue arises from improper neutralization of special elements in the 'raw' parameter, allowing authenticated administrators to append malicious SQL queries. This is due to insufficient escaping and lack of prepared statements in the plugin's SQL query handling. The vulnerability can be exploited to extract sensitive information from the database without impacting availability or integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact.

An attacker with Administrator-level access can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The impact is limited to confidentiality as integrity and availability are not affected. Since exploitation requires high privileges, the risk is mitigated somewhat by the need for authenticated administrative access. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to SQL query manipulation. Avoid using vulnerable versions of the plugin where possible.