A critical SQL Injection vulnerability (CVE-2026-124970) exists in WP BASE Booking plugin versions up to 6.5.2. This vulnerability allows an unauthenticated attacker to perform blind SQL injection, potentially leading to high confidentiality impact and partial denial of service. No patch information is currently available.