CVE-2024-7129

Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE

High · published September 13, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01138 · 66.3th percentile
Published
2024-09-13T06:00Z
EPSS history
Timeline
  • 13 SEP 06:00Z
    Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
    cvelistv5