A blind SQL injection vulnerability in the wpdevelop Booking Calendar plugin poses a significant risk of data exfiltration for affected WordPress environments.

The plugin suffers from an improper neutralization of special elements used in SQL commands (CWE-89), which allows an authenticated user with administrative privileges to perform blind SQL injection attacks.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive database contents, potentially exposing customer booking data and user information. Given the CVSS score of 7.6, this flaw represents a high-severity risk that could result in significant reputational damage and compliance failures if sensitive records are compromised.

Immediate Action: Administrators should monitor the official vendor channels for the release of a security update and apply the patch as soon as it becomes available.

Proactive Monitoring: Security teams should review database query logs for anomalous patterns or unexpected syntax that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a temporary layer of protection while awaiting a vendor-supplied patch.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

While this vulnerability requires administrative authentication, it remains a high-priority concern due to the nature of the data handled by the Booking Calendar plugin. Organizations are strongly advised to restrict administrative access to trusted personnel and apply the vendor patch immediately upon its release to close this security gap.