Description
WordPress Plugin Availability Calendar is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Availability Calendar version 1.2 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.2.1 or latest
References
https://github.com/xiahao90/CVEproject/blob/main/wordpress_Availability-Calendar_sqli.md
https://sploitus.com/exploit?id=WPEX-ID:FE49F48A-F97A-44FE-8D71-BE08E7CE4F83
https://plugins.svn.wordpress.org/availability-calendar/trunk/README.txt
Related Vulnerabilities
WordPress Plugin Content Aware Sidebars-Unlimited Widget Areas Security Bypass (3.8)
Apache HTTP Server Insufficient Verification of Data Authenticity Vulnerability (CVE-2022-31813)
WordPress Plugin Project Supremacy V3 Lite Cross-Site Scripting (1.1)
Ruby Resource Management Errors Vulnerability (CVE-2008-3443)