EIP-2026-113602

This exploit demonstrates an unauthenticated SQL injection vulnerability in the WordPress appointment-booking-calendar plugin (version <=1.1.23). The flaw arises from unsanitized input in the `cpabc_process_ready_to_go_appointment` function, allowing arbitrary SQL commands to be executed via the `itemnumber` parameter.