CVE-2022-0658: Wielebenwir Commonsbooking

Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days.

The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection

Affected products

• Wielebenwir Commonsbooking: before 2.6.8 (fixed in 2.6.8)

Published 2022-03-14. Last modified 2026-06-17.