CVE-2024-1207

CRITICAL

WP Booking Calendar <= 9.9 - Unauthenticated SQL Injection via calendar_request_params[dates_ddmmyy_csv]

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-1207. PoCs published by sahar042.

AI-analyzed exploit summary The repository contains a functional proof-of-concept for an unauthenticated SQL injection vulnerability in Booking Calendar <= 9.9. The exploit leverages a crafted POST request to admin-ajax.php with a malicious payload in the 'dates_ddmmyy_csv' parameter, triggering a time-based SQL injection.

Description

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Exploits (1)

nomisec WORKING POC

by sahar042 · poc

https://github.com/sahar042/CVE-2024-1207

View Code ZIP pw:eip

The repository contains a functional proof-of-concept for an unauthenticated SQL injection vulnerability in Booking Calendar <= 9.9. The exploit leverages a crafted POST request to admin-ajax.php with a malicious payload in the 'dates_ddmmyy_csv' parameter, triggering a time-based SQL injection.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Booking Calendar WordPress Plugin <= 9.9

No auth needed

Prerequisites: Access to the target WordPress site's admin-ajax.php endpoint

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032596%40booking&new=3032596%40booking&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/7802ed1f-138c-4a3d-916c-80fb4f7699b2?source=cve

Scores

CVSS v3 9.8

EPSS 0.0315

EPSS Percentile 86.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (2)

wpbookingcalendar/booking_calendar < 9.9.1

wpdevelop/Booking Calendar < 9.9

Published Feb 08, 2024

Tracked Since Feb 18, 2026