An unauthenticated SQL injection vulnerability in the Online Scheduling and Appointment Booking System WordPress plugin allows remote attackers to compromise database integrity.

The plugin is susceptible to SQL Injection (CWE-89) because it fails to sanitize user inputs before processing database queries. This vulnerability is particularly dangerous as it is exploitable by unauthenticated attackers, making it highly automatable.

With a CVSS score of 8.6, this vulnerability poses a severe threat to data confidentiality. An attacker could extract the entire contents of the WordPress database, including administrative credentials, user records, and sensitive business data, leading to significant reputational and regulatory consequences.

Immediate Action: Update the plugin to version 27.8 or later immediately to remediate the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax that indicate automated SQL injection attempts, such as the use of UNION statements or error-based injection strings.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious traffic and prevent exploitation of the input fields.

Public Exploit Available: false

Because this vulnerability is unauthenticated and automatable, the risk of automated exploitation is high. Administrators must prioritize updating the plugin to version 27.8 or removing it if the functionality is not business-critical, as this will mitigate the risk of unauthorized database access.