The Online Scheduling and Appointment Booking System WordPress plugin prior to version 27.8 contains a SQL injection vulnerability (CWE-89) due to improper sanitization and casting of a user-supplied parameter in unauthenticated front-end booking requests. This flaw allows unauthenticated attackers to inject SQL commands into queries executed by the plugin, potentially extracting sensitive information including password hashes from the backend database. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, no privileges required, and no user interaction needed. No known exploits in the wild or official patches have been documented as of the publication date.

Successful exploitation allows unauthenticated remote attackers to perform SQL injection attacks against the plugin's database. This can result in unauthorized disclosure of sensitive data such as password hashes. The vulnerability does not impact integrity or availability directly but compromises confidentiality significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to the booking functionality to trusted users only. Monitor vendor channels for updates and apply patches promptly when available.