Description
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Booking calendar, Appointment Booking System | < 3.2.2 | 3.2.2 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Booking Calendar <3.2.2 - Arbitrary File Upload http/cves/2022/CVE-2022-3982.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/4d91f3e1-4de9-46c1-b5ba-cc55b7726867 exploit vdb-entry technical-description