Not rated

CVE-2022-0739 The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used…

Description

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Affected products and versions

Product	Affected versions	Fixed in
BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin 1.0	earliest → < 1.0.11	1.0.11

Do you use BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin?

Track this CVE Watch BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2022-0739

Timeline

Published March 21, 2022
Last modified August 2, 2024

References

wpscan.com wpscan.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE