The BookingPress Appointment Booking Pro plugin (<=5.7.1) is vulnerable to SQL Injection through the 'store_service_date' parameter in the bpa_assign_staffmember_to_slots() function. The plugin uses stripslashes_deep() on user-supplied POST data but fails to use $wpdb->prepare() or any parameterization when embedding this data into a SQL LIKE clause. This improper neutralization of special elements (CWE-89) allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database. No official patch or remediation level has been published as of the data provided.

An unauthenticated attacker can exploit this SQL Injection vulnerability to extract sensitive information from the WordPress database used by the BookingPress Appointment Booking Pro plugin. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable functionality or plugin. Applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'store_service_date' parameter may provide temporary mitigation.