CVE-2018-20556: Booking Calendar Project Booking Calendar

High severity, CVSS 8.8. EPSS: 18.9% chance of exploitation in the next 30 days.

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id parameter.

Affected products

• Booking Calendar Project Booking Calendar: version 8.4.3 only

Published 2019-03-21. Last modified 2026-06-17.