CVE-2024-1207 is a critical, unauthenticated SQL injection in the WP Booking Calendar plugin for WordPress. Versions up to and including 9.9 are affected and NVD scores it 9.8. No login is required. Update to a release newer than 9.9 and review your database access logs.
What's affected
The record lists all versions of WP Booking Calendar up to and including 9.9. The input at fault is the calendar_request_params parameter for dates, which is placed into a query without sufficient escaping or preparation.
Unlike many plugin bugs, this one needs no account. An unauthenticated visitor can send the request, and that is why the vector shows no privileges required and a 9.8 score.
The record does not state the patched version. It points to a WordPress Trac changeset on the plugin's repository, named booking, and a Wordfence entry. I could not retrieve the Wordfence page, so confirm the fixed version from the plugin changelog.
Weakness class: CWE-89. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a score of 9.8.
How to check if you're exposed
The plugin directory name from the record's source links is booking. With WP-CLI:
wp plugin get booking --fields=name,version,status
Or open Plugins in the WordPress admin. A version of 9.9 or lower is affected. Booking sites tend to expose public calendar pages, so assume the vulnerable endpoint is reachable from the internet unless a web application firewall blocks it.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Update WP Booking Calendar to the newest release and verify the version is above 9.9.
- Take a database backup before and after the update so you can compare if something looks wrong.
- Review web server access logs for unusual requests to booking pages that include the calendar_request_params parameter, starting from early February 2024.
- Rotate any credentials stored in the WordPress database that an attacker could have read, such as API keys kept in plugin settings.
- Consider a web application firewall rule for SQL injection patterns as defence in depth, not as a replacement for the update.
Why it matters
The class is CWE-89. The query was built by joining a request value into SQL text. A bound parameter would have kept the data out of the command. The record says the plugin did neither escaping nor preparation.
Because exploitation needs no account, the exposure is the whole internet for any public site running an affected version. The record's description centres on extracting sensitive data from the database, which on a booking site can include customer names and contact details. The KEV flag is false and I found no advisory reporting exploitation, so the risk comes from the weakness itself.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a login needed to exploit CVE-2024-1207?
No. The record says unauthenticated attackers, and the CVSS vector shows no privileges required.
Which version fixes it?
The record does not say. Use the newest release and read the plugin changelog or the Wordfence entry for the exact number.
Sources
Last reviewed: 19 October 2026.
