Executive brief
The Booking Calendar Contact Form plugin for WordPress, which allows websites to manage reservations and contact forms, contains a security flaw. An attacker can use this vulnerability to access and steal sensitive information from the website's database without needing a password. This could lead to the exposure of customer data, site configuration details, or other private information stored on the server.
Technical details
The Booking Calendar Contact Form plugin for WordPress (up to version 1.0.23) is vulnerable to unauthenticated blind SQL injection. The flaw exists in the 'dex_bccf_get_option' and 'dex_bccf_filter_content' functions, where the 'calendar' parameter (and associated 'id' parameter in AJAX requests) is used in a SQL query without proper sanitization. An attacker can exploit this by sending specially crafted HTTP GET requests to the admin-ajax.php endpoint or by manipulating shortcode attributes. This allows for the execution of arbitrary SQL commands, enabling the extraction of sensitive data from the WordPress database. While the vulnerability was identified in 2016, it was officially assigned a CVE and published in NVD in 2026.
Affected products
- CodePeople (DWBooster) Booking Calendar Contact Form <= 1.0.23
Timeline
- 2016-02-08: disclosed: Initial discovery and exploit published by i0 SEC-LABORATORY
- 2026-06-15: advisory: CVE published to NVD dataset