PT-2025-51230 · WordPress · Booking Calendar

Marcin Dudek · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-14383

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Booking Calendar plugin for WordPress versions prior to 10.14.9

Description The Booking Calendar plugin for WordPress is susceptible to a time-based blind SQL injection. This occurs due to insufficient escaping of the dates to check parameter and inadequate preparation of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database. The vulnerable parameter is dates to check.

Recommendations Update the Booking Calendar plugin to version 10.14.9 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-14383

Affected Products

Booking Calendar

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14383 · Security Note
• https://twitter.com/VulmonFeeds/status/2000607555421155539 · Twitter Post
• https://t.me/CVEtracker/39839 · Telegram Post
• https://twitter.com/TheHackerWire/status/2000597690481344926 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3416518/booking/trunk/includes/_capacity/capacity.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/790f93b0-eb69-473f-a726-bfe215f5d870?source=cve · Note
• https://twitter.com/CVEnew/status/2000611204080009566 · Twitter Post