{"schemaVersion":3,"id":"CVE-2020-9372","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.","dates":{"published":"2020-03-04T18:12:31.000Z","modified":"2024-08-04T10:26:16.042Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.08612,"percentile":0.95081,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.08612},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.08612,"percentile":0.95081}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08612,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.08612,"percentile":0.95081}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_55B69230C49E983B","name":"Exploit Reference (drive.google.com)","source":"reference","url":"https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_2B950D6565C67383","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"48204","name":"WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection","source":"exploit-database","url":"https://www.exploit-db.com/exploits/48204","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["php"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"php","file":"exploits/php/webapps/48204.txt","codes":["CVE-2020-9372","CVE-2020-9371"]},"metasploit":null}],"exploitCount":3,"weaknesses":[{"id":"CWE-1236","name":"Improper Neutralization of Formula Elements in a CSV File","description":"The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1236.html"},{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","description":"The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/74.html"}],"affected":[{"vendor":"codepeople","product":"appointment_booking_calendar","name":"appointment booking calendar","label":"appointment_booking_calendar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.35","eol":null,"hubHref":"/vendor/codepeople/appointment_booking_calendar"},{"vendor":"wordpress","product":"appointment-booking-calendar","name":"Appointment Booking Calendar","label":"appointment-booking-calendar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.35","noFixRecorded":false,"fixedIn":"1.3.35"}],"versionsText":"< 1.3.35","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wordpress.org/plugins/appointment-booking-calendar/#developers","label":"wordpress.org/plugins/appointment-booking-calendar/","hostname":"wordpress.org","tags":["X Refsource MISC","Release Notes","Third Party Advisory"]},{"url":"https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9","label":"drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9","hostname":"drive.google.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://www.hotdreamweaver.com/support/view.php?id=815925","label":"www.hotdreamweaver.com/support/view.php?id=815925","hostname":"www.hotdreamweaver.com","tags":["X Refsource MISC","Permissions Required"]},{"url":"http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25b26369-76e3-44f0-8275-03fc6fc9705c","label":"www.wordfence.com/threat-intel/vulnerabilities/id/25b26369-76e3-44f0-8275-03fc6fc9705c","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-03-04T18:12:31.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T10:26:16.042Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":43,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T00:52:46.570Z","stale":false,"partial":false}}