Appointment Hour Booking <= 1.3.72 - CSV Injection

published 2022-11-29 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-51413

cvss: 5.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits: 0; none known

The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Patch / fix

links 1

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40ap… advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-23)

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

codepeople Appointment Hour Booking – Booking Calendar

Classification

Weakness

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

Technology feeds

WordPress rss critical rss

References

Sources

CVE List CVE-2022-4034
NVD CVE-2022-4034

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary