High severity · published Sep 13, 2024
CVE-2024-7129
Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin ·
before 1.6.7.43 · source: vendor
SS
Simply Schedule Appointments · Nsqua
before 1.6.7.43 · source: NVD
AB
Appointment Booking Calendar · Nsquared
before 1.6.7.43 · source: CISA
Affected product
AB
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7129
Exploit
https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4/
More from Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
4.8
CVE-2024-7877
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
4.8
CVE-2024-7876
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS