The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due insufficient escaping on user supplied lack of sufficient preparation existing query. This makes it possible unauthenticated attackers append additional queries into already that can be used extract sensitive information from database.