Unscored severity · published Sep 29, 2015
CVE-2015-7319
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to…
–
CVSS
2.4%
EPSS
No
On KEV
Description
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Calendar · Codepeople
through 1.1.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7319
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7319
Third Party Advisory
http://packetstormsecurity.com/files/133757/WordPress-Appointment-Booking-Calendar-1.1.7-SQL-Injection.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/536555/100/0/threaded
Patch
https://wordpress.org/plugins/appointment-booking-calendar/changelog/
wpvulndb.com
https://wpvulndb.com/vulnerabilities/8199
More from Appointment Booking Calendar
9.8
CVE-2025-46247
WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability
9.8
CVE-2016-10916
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319
8.8
CVE-2025-46241
WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability
8.8
CVE-2024-0856
Booking Calendar < 1.3.83 - CSRF appointment scheduling
8.8
CVE-2022-43482
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress