CVE-2016-20070: Privilege Escalation & Stored XSS in WordPress Booking Calendar Contact Form 1.0.23

Technical summary

CVE-2016-20070 involves privilege escalation and stored XSS in Booking Calendar Contact Form 1.0.23. The vulnerability stems from insufficient authorization checks and input sanitization on admin-ajax.php and admin.php endpoints. Authenticated subscribers can inject XSS payloads through parameters including price, name, calendar_language, and email_confirmation_to_user. The stored nature means payloads persist and execute whenever administrators access affected pages, enabling session hijacking, credential theft, or further site compromise.

Business impact

A compromised WordPress site running this plugin risks administrative account takeover, data theft, and potential site defacement. Malicious JavaScript running in administrator browsers can harvest login tokens, modify site content, install backdoors, or exfiltrate sensitive booking and customer data. For businesses using the plugin to manage appointments or event registrations, this creates reputational risk and potential compliance violations if customer information is exposed.

Affected systems

WordPress installations running Booking Calendar Contact Form version 1.0.23 are directly affected. Any site with this plugin version active and users holding subscriber-level or higher roles can be exploited. The vulnerability requires authentication, so it does not affect sites where user registration is disabled, though subscriber accounts created for customers or partners represent a practical attack vector.

Exploitability

The attack requires valid WordPress credentials at subscriber level or above—a low barrier since many sites permit customer registration or have test accounts. No special tools or complex techniques are needed; the attacker simply sends crafted requests to the vulnerable endpoints. The stored XSS component means the payload executes automatically when administrators log in, making it reliable and difficult to detect without log analysis. No user interaction beyond normal administrator actions is required for the attack to succeed.

Remediation

Immediately disable or remove Booking Calendar Contact Form 1.0.23 from production environments. Verify whether a patched version exists by consulting the plugin's official repository and security advisories from the vendor. If updates are available, apply them after testing in a staging environment. Audit recent administrator activity logs for signs of compromise, including unexpected plugin installations, user account creation, or option modifications.

Patch guidance

Check the WordPress plugin repository and vendor security communications for version 1.0.24 or later. The publisher should issue a patch that validates user capabilities before processing settings changes and sanitizes all user-supplied input before storage. Until a verified patch is available and tested, consider replacing the plugin with an alternative booking solution that maintains current security practices.

Detection guidance

Monitor for POST requests to admin-ajax.php and admin.php containing suspicious parameter values, especially those with HTML or JavaScript syntax in price, name, calendar_language, or email_confirmation_to_user fields. Log and alert on changes to plugin options originating from subscriber accounts. Review stored plugin configuration and option tables for encoded or obfuscated scripts. Search administrator browser console activity for execution of unexpected JavaScript originating from the plugin.

Why prioritize this

Although marked MEDIUM severity due to the requirement for prior authentication, this vulnerability poses significant risk because subscriber accounts are often created liberally on public-facing sites. The combination of privilege escalation and stored XSS creates a reliable path to administrative compromise. Organizations should prioritize patching or replacing this plugin promptly, especially if subscriber registration is enabled or if the site processes sensitive booking or payment data.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects that the attack requires authentication (PR:L) but has network access, low complexity, and impacts confidentiality and integrity across trust boundaries (S:C). The lack of availability impact and requirement for authenticated access prevent a higher score, but the combination of privilege escalation and stored XSS and the typical accessibility of subscriber accounts in production WordPress sites warrants urgent remediation.

Frequently asked questions