WordPress Booking Calendar Unauthenticated SQL Injection

WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WordPress Booking Calendar Contact Form version 1.0.23 is vulnerable to unauthenticated blind SQL injection through the admin-ajax.php endpoint. Attackers can inject malicious SQL commands via the 'id' parameter when calling the 'dex_bccf_calendar_ajaxevent' action, allowing them to extract sensitive database information without authentication. This vulnerability carries a CVSS score of 8.2 and affects any WordPress installation running the vulnerable plugin version. The attack requires no user interaction or credentials, making it particularly dangerous as threat actors can systematically extract sensitive data like user credentials, customer information, and internal database structures from affected WordPress instances.

Casky's 301 matched security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability. Practitioners using Casky would identify reconnaissance activities mapped to TA0001 (Resource Development), where attackers probe for vulnerable endpoints and parameters, and command execution patterns tied to TA0043 (Reconnaissance). The platform's skills enable detection of SQL injection attempts by analyzing HTTP requests to admin-ajax.php for suspicious SQL syntax in parameter values, blind SQL injection timing indicators, and database error responses. Security teams would see findings highlighting unauthenticated requests with crafted SQL payloads, unusual query patterns attempting data exfiltration, and behavioral anomalies consistent with database reconnaissance—allowing them to identify and remediate exploitation attempts before sensitive data is compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2016-20068.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2016-20068

Casky has 301 skills that investigate the attack patterns behind CVE-2016-20068. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn