PT-2022-13906 · WordPress · Booking Calendar

Ramuel Gall · Published 2022-05-10 · Updated 2022-05-17 · CVE-2022-1463

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Booking Calendar plugin for WordPress version 9.1 and earlier

Description The issue allows for PHP Object Injection via the bookingflextimeline shortcode. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.

Recommendations For versions up to and including 9.1, update to a version later than 9.1 to resolve the issue. As a temporary workaround, consider restricting access to the bookingflextimeline shortcode until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-1463

Affected Products

Booking Calendar

References · 5

• 🔥 https://wordfence.com/blog/2022/04/php-object-injection-in-booking-calendar-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2022-1463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1463 · Security Note
• https://t.me/cvenotify/30355 · Telegram Post
• https://t.me/cibsecurity/42288 · Telegram Post