CVE-2024-7129
📋 TL;DR
The Appointment Booking Calendar WordPress plugin before version 1.6.7.43 contains a Twig template injection vulnerability that allows authenticated users with administrative privileges to execute arbitrary code on the server. This affects WordPress sites using vulnerable versions of this plugin. Attackers can achieve remote code execution if they gain admin access.
💻 Affected Systems
- Appointment Booking Calendar WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Privileged attackers (compromised admin accounts) executing arbitrary code to maintain persistence or escalate access.
If Mitigated
Limited to authenticated admin users only, reducing attack surface if proper access controls are enforced.
🎯 Exploit Status
Exploitation requires admin-level access. Template injection leads to RCE through Twig engine.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.7.43
Vendor Advisory: https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Appointment Booking Calendar'. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.6.7.43+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Appointment Booking Calendar plugin until patched
wp plugin deactivate appointment-booking-calendar
Restrict admin access
allImplement strict access controls and MFA for WordPress admin accounts
🧯 If You Can't Patch
- Remove plugin entirely and use alternative booking solutions
- Implement web application firewall rules to block template injection patterns
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin get appointment-booking-calendar --field=versionVerify Fix Applied:
Confirm plugin version is 1.6.7.43 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to plugin admin endpoints
- Twig template syntax in user input fields
- Suspicious file creation/modification
Network Indicators:
- HTTP requests containing Twig template syntax to /wp-admin/ or plugin endpoints
SIEM Query:
source="wordpress" AND (uri_path="*appointment*" OR uri_path="*booking*") AND (http_method="POST" AND content="*{{*" OR content="*}}*"))