title: WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL Injection
description: The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue
problem types: CWE-89 SQL Injection
affected:
{
product: WP Simple Booking Calendar
vendor: Unknown
versions:
lessThan: 2.0.6, status: affected, version: 2.0.6, versionType: custom
}