CVE-2022-0658
Published: 14 March 2022
Summary
CVE-2022-0658 is a critical-severity SQL Injection (CWE-89) vulnerability in Wielebenwir Commonsbooking. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is an unauthenticated SQL injection (CWE-89) affecting the CommonsBooking WordPress plugin before version 2.6.8. It arises because the plugin fails to sanitize or escape the location parameter supplied to the calendar_data AJAX action before incorporating it into dynamically built SQL queries.
Unauthenticated remote attackers can exploit the flaw over the network without any user interaction. Successful exploitation grants full read/write access and the ability to disrupt the application, consistent with the CVSS 3.1 score of 9.8.
Public references on WPScan describe the affected endpoint and advise updating the plugin to version 2.6.8 or later to eliminate the injection vector. The associated EPSS score has remained flat at its recorded peak of 0.4725.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15751
Vulnerability details
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.