A vulnerability was found in Appointment Booking Calendar Plugin up to 1.6.9.9 on WordPress. It has been declared as critical. Impacted is an unknown function. Such manipulation of the argument order/append_where_sql leads to sql injection.
This vulnerability is referenced as CVE-2025-12166. It is possible to launch the attack remotely. No exploit is available.
