# CVE-2016-20068: CodePeople Booking Calendar Contact Form blind SQL injection

Source: https://junglewise.ai/threats/cve-2016-20068-codepeople-booking-calendar-contact-form-blind-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2016-20068 · Severity: high · CVSS 8.2 · Published 2026-06-15

The Booking Calendar Contact Form plugin for WordPress, which allows websites to manage reservations and payments, contains a security flaw that allows unauthorized individuals to access the site's database. By sending a specially crafted web request, an attacker can bypass security controls to extract sensitive information, including user credentials or customer data. This could lead to a full compromise of the website's data and potentially impact business operations and reputation.

Technologies: [CodePeople Booking Calendar Contact Form](https://junglewise.ai/threats/technologies/booking-calendar-contact-form). Vendors: [CodePeople](https://junglewise.ai/threats/vendors/codepeople).

## Quick answers

**Is CVE-2016-20068 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-20068 being exploited in the wild.

**How severe is CVE-2016-20068?** High severity, with a CVSS score of 8.2, published 15 June 2026.

**Which products and versions are affected?** CodePeople Booking Calendar Contact Form <= 1.0.23.

**Is there a fix for CVE-2016-20068?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-20068 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-20068?** Check whether you run CodePeople Booking Calendar Contact Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Booking Calendar Contact Form plugin for WordPress (up to version 1.0.23) is vulnerable to unauthenticated blind SQL injection. The root cause is a failure to sanitize the 'id' parameter within the 'dex_bccf_calendar_load2' function, which is subsequently used in a SQL query via 'dex_bccf_get_option'. An attacker can trigger this by sending a request to the 'admin-ajax.php' endpoint with the 'action' parameter set to 'dex_bccf_calendar_ajaxevent'. Successful exploitation allows a remote, unauthenticated attacker to extract sensitive data from the WordPress database. Additionally, the plugin is reportedly vulnerable to SQL injection via shortcode attributes and lacks proper authorization checks for administrative actions.

## Affected products

- CodePeople Booking Calendar Contact Form <= 1.0.23

## Timeline

- 2016-02-08: disclosed: Initial discovery and exploit publication by i0 SEC-LABORATORY.
- 2026-06-15: advisory: CVE published and NVD record created.

## References

- [http://wordpress.dwbooster.com/](http://wordpress.dwbooster.com/)
- [https://www.exploit-db.com/exploits/39423](https://www.exploit-db.com/exploits/39423)
- [https://www.vulncheck.com/advisories/wordpress-booking-calendar-contact-form-sql-injection](https://www.vulncheck.com/advisories/wordpress-booking-calendar-contact-form-sql-injection)

## Related threats

- [CodePeople Booking Calendar Contact Form privilege escalation and stored XSS](https://junglewise.ai/threats/cve-2016-20070-codepeople-booking-calendar-contact-form-privilege-escalation-and)
- [CodePeople Booking Calendar Contact Form blind SQL injection](https://junglewise.ai/threats/cve-2016-20069-codepeople-booking-calendar-contact-form-blind-sql-injection)