CVE-2024-7129
Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 13, 2024
- Updated
- Sep 15, 2025
- Reserved
- Jul 26, 2024
Description
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Appointment Booking Calendar — Simply Schedule Appointments Booking PluginUnknown |
|
References
- https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.