Quick answers
- Is CVE-2016-20068 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-20068 being exploited in the wild.
- How severe is CVE-2016-20068?
- High severity, with a CVSS score of 8.2, published 15 June 2026.
- Which products and versions are affected?
- CodePeople Booking Calendar Contact Form <= 1.0.23.
- Is there a fix for CVE-2016-20068?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2016-20068 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2016-20068?
- Check whether you run CodePeople Booking Calendar Contact Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Booking Calendar Contact Form plugin for WordPress (up to version 1.0.23) is vulnerable to unauthenticated blind SQL injection. The root cause is a failure to sanitize the 'id' parameter within the 'dex_bccf_calendar_load2' function, which is subsequently used in a SQL query via 'dex_bccf_get_option'. An attacker can trigger this by sending a request to the 'admin-ajax.php' endpoint with the 'action' parameter set to 'dex_bccf_calendar_ajaxevent'. Successful exploitation allows a remote, unauthenticated attacker to extract sensitive data from the WordPress database. Additionally, the plugin is reportedly vulnerable to SQL injection via shortcode attributes and lacks proper authorization checks for administrative actions.
Affected products
- CodePeople Booking Calendar Contact Form <= 1.0.23
Timeline
- 2016-02-08: disclosed: Initial discovery and exploit publication by i0 SEC-LABORATORY.
- 2026-06-15: advisory: CVE published and NVD record created.