PT-2018-17072 · WordPress · Booking Calendar

CVE-2018-5673

Published

2018-01-12

Updated

2019-03-05

CVSS v3.1

8.8

High

Vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7

Description: A security issue was found in the booking-calendar plugin for WordPress, where a CSRF exists via the "wp-admin/admin.php" API endpoint.

Recommendations: For version 2.1.7, update to a newer version that contains a fix for this issue.

Exploit

Fix

CSRF

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2018-5673

Booking Calendar