This vulnerability involves improper neutralization of special elements in SQL commands within the wpdevelop Booking Calendar plugin, enabling blind SQL injection. It affects all versions up to 10.14.15. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The vulnerability requires an attacker to have high privileges on the system, limiting the attack surface. There is no indication of integrity compromise, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for unusual database activity related to the Booking Calendar plugin. Avoid exposing administrative interfaces unnecessarily.