CVE-2016-20068: WordPress Booking Calendar SQLi Flaw

CVE-2016-20068 Overview

CVE-2016-20068 is an unauthenticated blind SQL injection vulnerability in the WordPress Booking Calendar Contact Form plugin version 1.0.23. The flaw resides in the dex_bccf_calendar_ajaxevent AJAX action handler exposed through admin-ajax.php. Remote attackers can supply crafted SQL payloads through the id parameter without authentication. Successful exploitation allows extraction of database contents, including WordPress user credentials and session data. The vulnerability maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can blind-extract sensitive database contents from any WordPress site running the vulnerable plugin version, with no user interaction required.

Affected Products

WordPress Booking Calendar Contact Form plugin version 1.0.23
WordPress installations exposing the admin-ajax.php endpoint with the plugin enabled
Sites running the affected plugin behind any authentication layer that does not block AJAX requests

Discovery Timeline

2026-06-15 - CVE-2016-20068 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20068

Vulnerability Analysis

The vulnerability stems from unsanitized user input passed directly into a SQL query inside the plugin's AJAX event handler. The plugin registers the dex_bccf_calendar_ajaxevent action and reads the id request parameter without applying WordPress prepared statements or input filtering. Because the action is hooked using wp_ajax_nopriv_, unauthenticated visitors can invoke it.

Attackers exploit the flaw by issuing HTTP POST or GET requests to /wp-admin/admin-ajax.php containing the action=dex_bccf_calendar_ajaxevent and id= parameters. The server returns no direct query results, requiring blind extraction techniques such as boolean-based or time-based payloads.

Root Cause

The root cause is missing parameterization of the id parameter before concatenation into a SQL statement. WordPress provides the $wpdb->prepare() method for safe query construction, but the plugin handler bypasses it. This [CWE-89] pattern allows arbitrary SQL syntax to be appended to the original query.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker enumerates targets running the plugin, then sends crafted requests to the AJAX endpoint. Time-based blind payloads using SLEEP() or conditional IF() expressions allow byte-by-byte extraction of wp_users, wp_usermeta, and wp_options table contents, including user_pass hashes and session tokens.

A representative exploitation request targets admin-ajax.php with the action parameter set to dex_bccf_calendar_ajaxevent and the id parameter containing a UNION-based or time-based SQL payload. Refer to Exploit-DB #39423 and the VulnCheck Advisory for the published proof-of-concept.

Detection Methods for CVE-2016-20068

Indicators of Compromise

HTTP requests to /wp-admin/admin-ajax.php containing action=dex_bccf_calendar_ajaxevent from unauthenticated sessions
Request bodies or query strings where the id parameter contains SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment markers (--, #, /*)
Anomalous response latency on admin-ajax.php consistent with time-based blind injection
Repeated requests from a single source iterating numeric or character ranges in the id parameter

Detection Strategies

Inspect web server access logs for the dex_bccf_calendar_ajaxevent action paired with non-numeric id values
Deploy WAF or reverse proxy rules that flag SQL metacharacters in WordPress AJAX parameters
Correlate database error logs and slow query logs with inbound HTTP requests to identify injection probing
Hunt for unexpected reads against wp_users or wp_usermeta originating from the WordPress database user

Monitoring Recommendations

Enable WordPress query logging or MySQL general query logging on internet-facing sites running the plugin
Alert on bursts of admin-ajax.php requests exceeding baseline volume for the dex_bccf_calendar_ajaxevent action
Monitor outbound traffic from web hosts for credential exfiltration following suspicious AJAX activity
Track changes to administrative WordPress accounts and newly created users as post-exploitation indicators

How to Mitigate CVE-2016-20068

Immediate Actions Required

Deactivate and remove the Booking Calendar Contact Form plugin version 1.0.23 from all WordPress installations
Upgrade to a vendor-supported release available from the plugin vendor site or replace it with a maintained alternative
Rotate all WordPress administrator passwords and invalidate active sessions if exploitation is suspected
Audit wp_users and wp_options for unauthorized accounts or modified siteurl values

Patch Information

Review the vendor resource for current plugin releases and apply the latest available version. If the plugin is no longer maintained, removal is the only reliable remediation. See the VulnCheck Advisory for additional remediation context.

Workarounds

Block unauthenticated access to admin-ajax.php requests carrying action=dex_bccf_calendar_ajaxevent at the WAF or reverse proxy layer
Apply virtual patching rules that reject non-numeric values in the id parameter for this action
Restrict access to the WordPress site by IP allowlist while remediation is in progress
Place the plugin behind HTTP authentication if temporary availability is required

bash

# Example nginx rule to block exploitation attempts against the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "dex_bccf_calendar_ajaxevent") {
        return 403;
    }
    if ($request_body ~* "action=dex_bccf_calendar_ajaxevent") {
        return 403;
    }
}