CVE-2022-3982

CRITICALNuclei

Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-3982 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 23, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 22, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Booking calendar, Appointment Booking System

Default status: unaffected

CVE ListBefore 3.2.2affected

booking_calendar

Browse wpdevart / booking_calendar
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Booking Calendar <3.2.2 - Arbitrary File UploadCVSS 9.8

WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

This vulnerability can lead to remote code execution, allowing attackers to take control of the affected WordPress website.

Remediation

Fixed in 3.2.2.

WeaknessesCWE-434
Authorstheamanrawat
Template tagscvecve2022rcewpscanwordpresswp-pluginwpbooking-calendarunauthenticatedintrusivewpdevartvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wpdevart:booking_calendar:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/4d91f3e1-4de9-46c1-b5ba-cc55b7726867 https://wordpress.org/plugins/booking-calendar/ https://nvd.nist.gov/vuln/detail/CVE-2022-3982 https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2