Typps Calendarista SQL injection

Technical summary

Calendarista is a WordPress appointment and booking plugin. One of its parameters reaches an SQL statement without proper neutralisation, letting an authenticated user interact with the database directly rather than only through the booking logic.

The published vector puts privileges required at low, so a low-privileged account is sufficient.

Impact

Unauthorised read access to the booking data and to the rest of the WordPress database, from an account that should only be able to make a booking.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista. This issue affects Calendarista: from n/a through 15.5.7.

Remediation

Patchstack’s published remediation is to update to 15.5.9 or a higher version.

References

• NVD entry
• CVE record (MITRE)
• Patchstack advisory

We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.