CVE-2016-20068

Name of the Vulnerable Software and Affected Versions WordPress Booking Calendar Contact Form versions prior to 1.0.24

Description An unauthenticated blind SQL injection exists due to insufficient escaping of user-supplied parameters and lack of preparation in SQL queries. This allows remote attackers to execute arbitrary SQL queries and extract sensitive database information. The issue occurs when sending requests to the 'admin-ajax.php' endpoint with the action parameter set to 'dex bccf calendar ajaxevent' and injecting malicious code through the id or calendar parameters.

Recommendations Update WordPress Booking Calendar Contact Form to a version newer than 1.0.23. Avoid using the id and calendar parameters in the 'admin-ajax.php' endpoint until the update is applied.