Security readout for executives and security teams
Plain-English summary
CVE-2021-24555 affects the WordPress Diary & Availability Calendar plugin. A logged-in low-privilege user could trigger a database query with unsafe input. The source also says the action lacks CSRF and capability checks, increasing risk where public registration or many subscriber accounts exist.
Executive priority
Prioritize remediation on internet-facing WordPress sites with user registration. The risk is higher than typical authenticated-only bugs because subscriber-level users may be numerous or easy to create.
Technical view
The daac_delete_booking_callback AJAX handler for daac_delete_booking passes the POST id value into SQL without proper sanitisation, validation, or escaping. The action also lacks CSRF and capability checks, making it reachable by any authenticated user according to the source bundle.
Likely exposure
Exposure is limited to WordPress sites running Diary & Availability Calendar version 1.0.3 or earlier, especially sites with subscriber accounts or open user registration.
Exploitation context
The bundle does not cite active exploitation, KEV listing, public weaponization, or a CVSS score. The issue requires authentication, but subscriber-level access is commonly attainable on some WordPress sites.
Researcher notes
Evidence is strong for the vulnerable code pattern and missing access controls, but incomplete for severity scoring, fixed versions, and exploitation in the wild. Validate against local plugin code and vendor guidance before declaring closure.
Mitigation direction
- Check vendor or plugin repository guidance for a fixed release or removal recommendation.
- Disable or remove Diary & Availability Calendar if no maintained fixed version is available.
- Restrict WordPress user registration and remove unnecessary subscriber accounts.
- Review database and application logs for suspicious authenticated AJAX activity.
Validation and detection
- Inventory WordPress sites for Diary & Availability Calendar installations and versions.
- Confirm whether version 1.0.3 or earlier is present.
- Review whether public registration or broad subscriber access is enabled.
- Verify remediation by confirming the vulnerable plugin is updated, disabled, or removed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24555 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/8eafd84b-6214-450b-869b-0afe7cca4c5fCVE reference · x_refsource_MISC
- https://codevigilant.com/disclosure/2021/wp-plugin-diary-availability-calendar/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.