This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Unauthenticated SQL Injection in WP Booking Calendar. ๐ฅ **Consequences**: Attackers can manipulate database queries, leading to data theft, modification, or deletion.โฆ
๐ต๏ธ **Privileges**: Unauthenticated access required. ๐๏ธ **Data**: Full database read/write access. ๐ **Impact**: High Confidentiality, Integrity, and Availability impact (CVSS H).
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: LOW. ๐ช **Auth**: None required (Unauthenticated). โ๏ธ **Config**: Standard WordPress AJAX endpoint (`admin-ajax.php`). Easy to trigger via POST requests.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Exploit**: YES. ๐ **PoC**: Publicly available on GitHub (sahar042/CVE-2024-1207). ๐ **Wild Exploitation**: High risk due to simplicity and lack of auth requirement.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for `admin-ajax.php` with `action=WPBC_AJX_BOOKING__CREATE`. ๐ก **Indicator**: Look for SQL errors or unexpected data in responses when injecting payloads into `dates_ddmmyy_csv`.
Q8Is it fixed officially? (Patch/Mitigation)
๐ ๏ธ **Fix**: Update to version > 9.9. ๐ **Patch**: Developer released fix in changeset 3032596. โ **Status**: Official mitigation available via plugin update.
Q9What if no patch? (Workaround)
๐ง **Workaround**: If unpatched, restrict access to `admin-ajax.php` via WAF rules. ๐ซ **Block**: Filter malicious payloads in `dates_ddmmyy_csv` parameter. ๐ **Disable**: Temporarily disable the plugin if not critical.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Priority**: CRITICAL. โฑ๏ธ **Urgency**: Immediate action required. ๐ข **Reason**: Unauthenticated, high impact, and public PoC exist. Patch immediately to prevent data breach.