CVE-2024-7129
Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.2EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
13 Sep 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Appointment Booking Calendar — Simply Schedule Appointments Booking PluginWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →