CVE-2024-7129: Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7129?
CVE-2024-7129 is considered to have a high severity due to its potential for remote code execution.
How do I fix CVE-2024-7129?
To fix CVE-2024-7129, you should update the Simply Schedule Appointments Booking Plugin to version 1.6.7.43 or later.
What type of vulnerability is CVE-2024-7129?
CVE-2024-7129 is a Twig Template Injection vulnerability that can lead to remote code execution.
Which versions of the Simply Schedule Appointments Booking Plugin are affected by CVE-2024-7129?
CVE-2024-7129 affects versions of the Simply Schedule Appointments Booking Plugin prior to 1.6.7.43.
Who is affected by CVE-2024-7129?
Any WordPress users utilizing versions of the Simply Schedule Appointments Booking Plugin before 1.6.7.43 are at risk from CVE-2024-7129.