The JetBooking plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) through the 'check_in_date' parameter in versions up to 4.0.3. The vulnerability arises because user input is not properly escaped or prepared before being included in SQL queries. This allows unauthenticated attackers to append malicious SQL code to existing queries, potentially exposing sensitive data from the backend database. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

An attacker can exploit this vulnerability remotely without authentication to extract sensitive information from the database by injecting SQL commands via the 'check_in_date' parameter. The integrity and availability of the system are not impacted according to the CVSS vector, but confidentiality is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Crocoblock's advisories for updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'check_in_date' parameter.