CSV Injection Vulnerability in Appointment Hour Booking Plugin for WordPress
CVE-2022-4034
5.8MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 29 November 2022
What is CVE-2022-4034?
The Appointment Hour Booking Plugin for WordPress is susceptible to CSV Injection, allowing unauthenticated attackers to insert untrusted input during booking creation. This compromised content can be exported as a CSV file, which may lead to code execution if the file is downloaded and executed in a vulnerable environment. Users are advised to update their plugin to the latest version to mitigate these risks.
Affected Version(s)
Appointment Hour Booking – WordPress Booking Plugin * <= 1.3.72