Vulnerability · Published Mar 21, 2022 · Assigned by WPScan

CVE-2022-0739BookingPress < 1.0.11 - Unauthenticated SQL Injection

Critical 9.8

In plain English

A critical-severity SQL injection in BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 37.4% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)37.4%top 1.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Metasploit, Public PoC

Official description

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Affected products (as reported)

Vendor	Product	Versions
Unknown	BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin	1.0.11 – before 1.0.11

Weakness: CWE-89

References

https://wpscan.com/vulnerability/388cd42d-b61a-42a4-8604-99b812db2357 x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2684789 x_refsource_CONFIRM