CVE Database /
CVE-2024-1207
CVE · Critical
CVE-2024-1207 — Booking Calendar [booking] < 9.9.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-1207
|
Booking Calendar [booking] < 9.9.1 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Critical
9.8
|
< 9.9.1
|
9.9.1 |
2024-02-07 |
—
|
CVE-2024-1207
The WP Booking Calendar plugin contains a SQL injection flaw affecting versions through 9.9 in the 'calendar_request_params[dates_ddmmyy_csv]' parameter, which fails to properly escape user input and uses unprotected SQL queries. This vulnerability permits unauthenticated attackers to inject arbitrary SQL commands and access sensitive database information.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings