This vulnerability (CVE-2026-48882) in the WP Time Slots Booking Form plugin by codepeople is an SQL Injection issue classified under CWE-89. It affects versions up to 1.2.50 and allows an attacker with low privileges to inject SQL commands, potentially compromising data confidentiality and causing partial denial of service. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The attack requires network access and low privileges but no user interaction, and it affects the security scope beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin functionality to trusted users and monitor for suspicious activity related to SQL injection attempts.