CVE-2022-0658: 
WordPress vulnerability analysis and mitigation

CVE-2022-0658 affects the CommonsBooking WordPress plugin versions before 2.6.8. The vulnerability was discovered and publicly disclosed on February 21, 2022. This security issue exists in the calendar_data AJAX action functionality of the plugin, which is accessible to unauthenticated users (WPScan).

The vulnerability is classified as an SQL Injection (SQLI) with a CVSS v3.1 base score of 9.8 (CRITICAL). The issue occurs because the plugin fails to properly sanitize and escape the location parameter in the calendar_data AJAX action before using it in dynamically constructed SQL queries. This vulnerability is categorized as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD).

As an unauthenticated SQL injection vulnerability, successful exploitation could allow attackers to execute arbitrary SQL commands on the underlying database. This could potentially lead to unauthorized access to sensitive data, manipulation of database contents, and possible compromise of the WordPress installation (WPScan).

The vulnerability is exploitable by unauthenticated users through the calendar_data AJAX action. A proof of concept exists demonstrating how an attacker can trigger a time-based SQL injection by sending a specially crafted request to the wp-admin/admin-ajax.php endpoint (WPScan).

Users should immediately upgrade to CommonsBooking version 2.6.8 or later, which contains the fix for this vulnerability (WPScan).