High severity · published Nov 29, 2022
CVE-2022-4034
Appointment Hour Booking <= 1.3.72 - CSV Injection
7.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AH
Appointment Hour Booking – Booking Calendar · codepeople
through 1.3.72 · source: vendor
AH
Appointment Hour Booking · Dwbooster
through 1.3.72 · source: NVD
Affected product
AH
Appointment Hour Booking – Booking Calendar
codepeople
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4034
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a77b7a-65ad-4334-99c9-92cc79e60bee?source=cve
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4034
More from Appointment Hour Booking – Booking Calendar
7.2
CVE-2026-96573
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
6.1
CVE-2022-4035
Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form
5.3
CVE-2022-4036
Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass
4.4
CVE-2026-1083
Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration