PT-2026-49207 · Undefined · Undefined

Published 2026-06-15 · Updated 2026-06-15 · CVE-2016-20069

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-20069

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-20069 · Security Note
• https://exploit-db.com/exploits/39423 · Note
• https://vulncheck.com/advisories/wordpress-booking-calendar-contact-form-sql-injection-2 · Note
• http://wordpress.dwbooster.com · Note