Input validation vulnerability in Booking calendar, Appointment Booking System 3.2.9

The Booking Calendar plugin for WordPress is vulnerable to a type of cyber attack known as SQL Injection. This plugin has a search function that, if exploited, allows people with certain privileges on the website access to sensitive information stored in the database. Versions of this plugin up to and including 3.2.8 are vulnerable because of how they escape user supplied parameters and the lack of preparation on the existing SQL query. Administrators can give access to the plugin’s Administrative pages to any user role, which means other roles may be able to exploit the vulnerability if they have been given access.