Unauthenticated SQL Injection in WordPress Booking Calendar

WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WordPress Booking Calendar Contact Form versions up to 1.0.23 suffer from a critical unauthenticated blind SQL injection vulnerability in its shortcode processing logic. The vulnerability stems from insufficient input sanitization on the calendar parameter, allowing attackers to inject arbitrary SQL commands without authentication. This affects any WordPress installation using the vulnerable plugin, potentially exposing sensitive database information including user credentials, personal booking data, and site configuration details. The CVSS score of 8.2 reflects the severity—attackers can extract entire databases through blind SQL injection techniques without any legitimate access credentials.

Casky's 301 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Resource Development (TA0001) and Reconnaissance (TA0043) phases. Practitioners using Casky would identify SQL injection payloads in shortcode parameters through pattern recognition of common injection syntax (UNION-based, time-based blind, and error-based techniques). The platform would flag suspicious database query structures, unusual parameter encoding, and timing anomalies in shortcode processing. Findings would highlight the attack chain: initial reconnaissance of the WordPress environment, followed by crafting malicious shortcode parameters designed to exfiltrate sensitive data. Security teams would receive specific indicators showing how attackers probe the calendar parameter for injection points and escalate to full database compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2016-20069.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2016-20069

Casky has 301 skills that investigate the attack patterns behind CVE-2016-20069. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn