Input validation vulnerability in Booking calendar, Appointment Booking System 3.2.11

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to a type of attack called SQL Injection. This attack affects all versions up to, and including, 3.2.11. With this type of attack, an attacker can gain access to sensitive information from the database, if they have administrator-level access. This is possible because of insufficient escaping on the user supplied parameter and a lack of sufficient preparation on the existing SQL query.