vulnerability

WordPress Plugin: commonsbooking: CVE-2022-0658: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Try Surface Command
Back to search
Severity
7
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Feb 21, 2022
Added
May 15, 2025
Modified
Jun 24, 2025

Description

The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection

Solution

commonsbooking-plugin-cve-2022-0658

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today