CVE-2021-24555

Katalog CVE

CVSS 8.8 · High EPSS 0,82%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada roosty diary-availability-calendar. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.

Rincian

Terbit di NVD

23 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://codevigilant.com/disclosure/2021/wp-plugin-diary-availability-calendar/ exploit · advisory pihak ketiga
• https://wpscan.com/vulnerability/8eafd84b-6214-450b-869b-0afe7cca4c5f exploit · advisory pihak ketiga