What the vulnerability does
01Description
A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.
Explanation of Vulnerability in Simple Terms
02Summary
The CP Appointment Calendar Plugin contains a SQL injection vulnerability in its database query handling. An authenticated user with low privileges can inject malicious SQL code to read, modify, or delete data from the site's database. The vulnerability requires valid login credentials but no additional user interaction. Sites running affected versions should update immediately.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data in the site database by injecting SQL commands.
Potential impact on your site
04Site Impact
Unauthorized access to sensitive data, appointment records, or user information; potential data corruption or loss.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
April 10, 2023
CVE published
August 6, 2024
Record updated
