CVE-2019-12239 Cross-site request forgery in n/a
Attackers can exploit missing CSRF protection to trigger SQL injection actions requiring administrative access in the WP Booking System plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12239?
CVE-2019-12239 is a high-severity vulnerability in n/a, published on 20 May 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
Which versions are affected by CVE-2019-12239?
It affects 1 product.
Products include Wpbookingsystem Wp Booking System.
How do I fix CVE-2019-12239?
No fix has been published for CVE-2019-12239 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12239 being exploited?
There is no known exploitation of CVE-2019-12239 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-8797 WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
- CVE-2017-2168 Cross-site scripting in WP Booking System Free version
- CVE-2023-24402 WordPress WP Booking System Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS)
- CVE-2021-25061 WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
Sources
Also known as GHSA-m27g-fr8f-5p8f.