CVE-2018-20556

Vulnerability

The WordPress Booking Calendar plugin (by oplugins) version 8.4.3 (and possibly older versions) contains an authenticated SQL injection vulnerability in the booking_id parameter. The parameter is used in POST requests for actions such as deleting or restoring bookings, and it is not properly sanitized before being used in SQL queries. The vulnerability is present in the plugin's control panel interface when an authenticated user interacts with booking entries.

Exploitation

An attacker must have valid WordPress credentials (at least subscriber or higher role) to access the WordPress admin panel. The following steps are required:

1. Log in to WordPress and navigate to the Booking Calendar plugin page.
2. Select any existing booking entry and click the 'Trash Can' button to trigger a delete action.
3. Use a proxy (e.g., Burp Suite) to capture the resulting POST request.
4. Identify the booking_id parameter in the request body.
5. Append a malicious SQL payload after the numeric ID. For example, injecting ) AND SLEEP(100) AND (1=1 causes a time-based delay, confirming SQL injection.

The parameter is vulnerable to boolean-based, error-based, and time-based injection. Tools like sqlmap can automate exploitation to extract data or obtain an OS shell.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary SQL commands, leading to:

• Reading arbitrary data from the WordPress database (e.g., usernames, password hashes, user metadata).
• Potentially escalating to remote code execution if the database user has file write privileges (e.g., writing a webshell via INTO OUTFILE or using sqlmap --os-shell).
• Full compromise of the WordPress site, including privilege escalation and data exfiltration.

Mitigation

As of the available references, the vendor (oplugins) has not released a patched version specifically addressing CVE-2018-20556. The affected version is 8.4.3, and users should upgrade to the latest version of the Booking Calendar plugin if a fix has been silently applied in later releases. If no update is available, administrators should restrict access to the WordPress admin panel to trusted users only, or disable the plugin until a patch is confirmed. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (as of the publication date).

[1][2]