CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
Priority MEDIUM 52CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
Why it matters now
EPSS 0.07518 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed CommonsBooking (Unknown): 2.6.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | CommonsBooking | 2.6.8 to before 2.6.8 | 2.6.8 | Patch available | CNA |
- CommonsBooking VendorUnknown Affected 2.6.8 to before 2.6.8 Fixed in 2.6.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wielebenwir:commonsbooking:*:*:*:*:*:wordpress:*:* | before 2.6.8 | Vulnerable | Wielebenwir |
- cpe:2.3:a:wielebenwir:commonsbooking:*:*:*:*:*:wordpress:*:* Versions before 2.6.8 Vulnerable ·Wielebenwir
Remediation
- Fix · CNA CommonsBooking (Unknown) Fixed in 2.6.8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0658
- 2026-10-03 Alias added: GHSA-7gp5-vwvv-wq8v
- 2026-10-13 EPSS moved to the 95th–99th percentile
- 2026-10-18 EPSS moved to the 90th–95th percentile
References
More Wielebenwir Commonsbooking vulnerabilities
- TI-2024-04083 CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF CVSS 3.1MEDIUM 6.5
- TI-2024-04082 CB (legacy) <= 0.9.4.18 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
Sources
- CVE-2022-0658 · CVE Program
- CVE-2022-0658 · NVD
- FIRST EPSS
- GHSA-7gp5-vwvv-wq8v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences