CVE-2019-12239

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89 CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dumpco.re/bugs/wp-plugin-wp-booking-system-sqliExploit, Third Party Advisory
https://wordpress.org/plugins/wp-booking-system/#developersRelease Notes
https://wpvulndb.com/vulnerabilities/9284Third Party Advisory
http://dumpco.re/bugs/wp-plugin-wp-booking-system-sqliExploit, Third Party Advisory
https://wordpress.org/plugins/wp-booking-system/#developersRelease Notes
https://wpvulndb.com/vulnerabilities/9284Third Party Advisory

Timeline

Published: May 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-12247.5An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who CVE-2019-122409.8The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.CVE-2019-122419.8The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handle CVE-2019-122437.5Istio 1.1.x through 1.1.6 has Incorrect Access Control.CVE-2019-122455.3SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to CVE-2019-122464.3SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.CVE-2019-122477.5QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environme CVE-2019-122484.3An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edit CVE-2019-12257.5An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who CVE-2019-122506.1IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorC CVE-2019-122518.8sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.CVE-2019-122526.5In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its num