CVE-2016-20068 Details
Description
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.
A blind SQL injection vulnerability has been identified in the WordPress Booking Calendar Contact Form plugin, specifically in version 1.0.23. This vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. The exploitation occurs via the admin-ajax.php endpoint, with the action parameter set to 'dex_bccf_calendar_ajaxevent'. The vulnerability arises because the plugin fails to properly sanitize the 'id' parameter before using it in SQL queries, enabling attackers to manipulate the SQL command and extract sensitive database information.
Users are advised to update the WordPress Booking Calendar Contact Form plugin to version 1.0.24 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 15, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.exploit-db.com/exploits/39423 | [email protected] | BundleExploit |
| https://www.vulncheck.com/advisories/wordpress-booking-calendar-contact-form-sql-injection | [email protected] | AdvisoryExploit |
| http://wordpress.dwbooster.com/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DWBooster Booking Calendar Contact Form | <= 1.0.23 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | New CVE Received | [email protected] |