CVE-2016-20069
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress Booking Calendar Contact Form plugin version 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries.
Risk Assessment
Attackers can inject SQL commands through the calendar shortcode parameter, allowing them to execute arbitrary SQL queries and extract sensitive information from the database.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures such as input filtering and validation.
Original NVD description (English source)
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.