High severity · published May 20, 2019
CVE-2019-12239
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access
7.2
CVSS
0.9%
EPSS
No
On KEV
Description
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WB
WP Booking System · Wpbookingsystem
before 1.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12239
Exploit
http://dumpco.re/bugs/wp-plugin-wp-booking-system-sqli
Release Notes
https://wordpress.org/plugins/wp-booking-system/#developers
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9284
More from WP Booking System
6.1
CVE-2024-8797
WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
6.1
CVE-2017-2168
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to…
5.4
CVE-2021-25061
The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page
4.8
CVE-2023-24402
WordPress WP Booking System Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS)