Description
WordPress Plugin Availability Calendar is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Availability Calendar version 1.2 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.2.1 or latest
References
https://github.com/xiahao90/CVEproject/blob/main/wordpress_Availability-Calendar_sqli.md
https://sploitus.com/exploit?id=WPEX-ID:FE49F48A-F97A-44FE-8D71-BE08E7CE4F83
https://plugins.svn.wordpress.org/availability-calendar/trunk/README.txt
Related Vulnerabilities
MySQL CVE-2022-21326 Vulnerability (CVE-2022-21326)
Apache HTTP Server Cryptographic Issues Vulnerability (CVE-2009-3555)
MySQL CVE-2019-2685 Vulnerability (CVE-2019-2685)
Joomla Cryptographic Issues Vulnerability (CVE-2011-4321)
WordPress Plugin Poll, Survey, Questionnaire and Voting system SQL Injection (1.5.2)