CVE-2024-10856: 
WordPress vulnerability analysis and mitigation

The Booking Calendar WpDevArt plugin for WordPress contains a time-based, blind SQL injection vulnerability (CVE-2024-10856) in versions up to and including 3.2.19. The vulnerability exists in the id parameter of the "wpdevart_booking_calendar" shortcode and requires the "delete_prev_date" theme option to be enabled (NVD).

The vulnerability stems from insufficient escaping of the user-supplied id parameter and lack of proper SQL query preparation in the "wpdevart_booking_calendar" shortcode. The CVSS v3.1 base score is 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD).

When successfully exploited, this vulnerability allows authenticated attackers with contributor-level access or above to append additional SQL queries to existing ones, potentially extracting sensitive information such as passwords from the database (NVD).

Users should upgrade to a version newer than 3.2.19 when available. In the meantime, it is recommended to ensure that the "delete_prev_date" theme option is disabled and to restrict contributor-level access to trusted users only (NVD).