WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection
CVE-2023-50851

7.6HIGH

Key Information:

Vendor
N Squared
Status
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Vendor
CVE Published:
28 December 2023

Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is susceptible to an SQL Injection vulnerability that occurs due to improper neutralization of special elements used in SQL commands. This flaw, present in versions before 1.6.6.1, may enable an attacker to execute arbitrary SQL queries, potentially compromising sensitive data within the application's database. It is crucial for users to update to the latest version to mitigate the associated risks.

Affected Version(s)

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.6.1

References

https://patchstack.com/database/vulnerability/simply-sche...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Daffa (Patchstack Alliance)
.