CVE-2015-7319
HighSummary
The Appointment Booking Calendar plugin for WordPress before version 1.1.8 contains an SQL injection vulnerability in the cpabc_appointments_admin_int_calendar_list.inc.php file. This allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
Risk Assessment
This vulnerability could lead to unauthorized access to the database, jeopardizing the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to update the plugin to the latest version to eliminate this vulnerability and conduct a security audit of the database.
Other vulnerabilities in Appointment Booking Calendar plugin for WordPress
See all- CVE-2026-1856Medium
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via custom booking field labels in all versions up to and including 1.4.4 due to insufficient input sanitization and output escaping.
- CVE-2026-12111Medium
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function.
Original NVD description (English source)
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.