Executive brief
The Booking Calendar Contact Form plugin for WordPress, which allows websites to manage reservations and payments, contains a security flaw that allows unauthorized individuals to access the site's database. By sending a specially crafted web request, an attacker can bypass security controls to extract sensitive information, including user credentials or customer data. This could lead to a full compromise of the website's data and potentially impact business operations and reputation.
Technical details
The Booking Calendar Contact Form plugin for WordPress (up to version 1.0.23) is vulnerable to unauthenticated blind SQL injection. The root cause is a failure to sanitize the 'id' parameter within the 'dex_bccf_calendar_load2' function, which is subsequently used in a SQL query via 'dex_bccf_get_option'. An attacker can trigger this by sending a request to the 'admin-ajax.php' endpoint with the 'action' parameter set to 'dex_bccf_calendar_ajaxevent'. Successful exploitation allows a remote, unauthenticated attacker to extract sensitive data from the WordPress database. Additionally, the plugin is reportedly vulnerable to SQL injection via shortcode attributes and lacks proper authorization checks for administrative actions.
Affected products
- CodePeople Booking Calendar Contact Form <= 1.0.23
Timeline
- 2016-02-08: disclosed: Initial discovery and exploit publication by i0 SEC-LABORATORY.
- 2026-06-15: advisory: CVE published and NVD record created.