Login Request a demo
High severity · published Mar 4, 2020
CVE-2020-9372
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then…
7.8
CVSS
8.6%
EPSS
No
On KEV
Description
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Calendar · Codepeople
before 1.3.35 · source: NVD
Affected product
AB
Appointment Booking Calendar
Codepeople
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9372
Exploit
http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html
Exploit
https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9
Release Notes
https://wordpress.org/plugins/appointment-booking-calendar/#developers
Permissions Required
https://www.hotdreamweaver.com/support/view.php?id=815925
More from Appointment Booking Calendar
9.8
CVE-2025-46247
WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability
9.8
CVE-2016-10916
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319
8.8
CVE-2025-46241
WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability
8.8
CVE-2024-0856
Booking Calendar < 1.3.83 - CSRF appointment scheduling
8.8
CVE-2022-43482
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress