## Summary
The Appointment Booking Calendar — Simply Schedule Appointments Booking WordPress plugin is vulnerable to SQL Injection (CWE-89) via the fields parameter. The issue affects all versions up to and including 1.6.10.0 and can be exploited by unauthenticated attackers to extract sensitive database information.
## Technical Details
- Vulnerability type: SQL Injection caused by insufficient escaping of the user-supplied fields parameter and insufficient preparation of an existing SQL query.
- Attack surface: the fields parameter (exact endpoint not provided in the available data).
- Impacted data: attackers may append additional SQL queries to the original query to extract sensitive information, including:
- usernames
- email addresses
- password hashes
- Preconditions: unauthenticated access (PR:N) over the network (AV:N).
## Affected
- WordPress plugin: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- Affected versions: <= 1.6.10.0
## Impact
- Confidentiality impact is high (C:H): database contents can be exfiltrated via injected SQL.
- Integrity and availability impacts are not indicated (I:N, A:N).
- Overall severity is high (CVSS 7.5, AC:L, PR:N, UI:N, S:U).
## Mitigation
1. Upgrade the plugin to a version beyond 1.6.10.0 where the SQL injection in the fields parameter is fixed.
2. If immediate upgrade is not possible, restrict network access to the vulnerable functionality and add compensating controls (e.g., WAF rules) to block requests containing suspicious fields parameter payloads.
3. Rotate credentials and invalidate sessions if password hashes or user data may have been exposed, and monitor for follow-on probing consistent with SQLi attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-89