Time-Based Blind SQL Injection in Booking Calendar Plugin for WordPress

CVE-2025-14383

What is CVE-2025-14383?

The Booking Calendar plugin for WordPress is exposed to a time-based blind SQL Injection vulnerability via the 'dates_to_check' parameter. All versions up to and including 10.14.8 suffer from inadequate input sanitization, allowing attackers to manipulate the SQL queries with malicious payloads. As a result, unauthorized users can form and execute additional queries to extract sensitive information from the underlying database. This vulnerability underscores the importance of secure coding practices and regular plugin updates.

References