CVE-2022-1463 : Security Advisory and Response

WordPress Booking Calendar plugin version 9.1 and below is susceptible to PHP Object Injection via a specific shortcode, potentially allowing unauthorized users to execute malicious PHP objects on the target site.

Understanding CVE-2022-1463

This CVE identifies a vulnerability in the Booking Calendar plugin for WordPress that enables PHP Object Injection through the [bookingflextimeline] shortcode in versions up to and including 9.1.

What is CVE-2022-1463?

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This enables users with subscriber-level access or higher to call arbitrary PHP objects on the affected website.

The Impact of CVE-2022-1463

The vulnerability poses a high severity risk with a CVSS v3.1 base score of 8.8. It has a low attack complexity and requires no user interaction. The exploit could result in high confidentiality, integrity, and availability impacts on the targeted system.

Technical Details of CVE-2022-1463

The following technical details provide insights into the vulnerability and its implications:

Vulnerability Description

The vulnerability allows unauthorized users to execute malicious PHP objects via the identified shortcode, leading to potential security breaches.

Affected Systems and Versions

WordPress Booking Calendar plugin versions up to and including 9.1 are affected by this vulnerability.

Exploitation Mechanism

Subscriber-level users and above can exploit the vulnerability by leveraging the [bookingflextimeline] shortcode to call arbitrary PHP objects on vulnerable sites.

Mitigation and Prevention

To address and mitigate the risks associated with CVE-2022-1463, consider the following steps:

Immediate Steps to Take

Update the Booking Calendar plugin to version 9.1.1 or newer to patch the vulnerability and prevent potential exploitation.

Long-Term Security Practices

Regularly update all plugins and themes to their latest versions to ensure protection against known vulnerabilities.

Patching and Updates

Stay informed about security advisories and promptly apply patches and updates to all WordPress components to maintain a secure website environment.