My Calendar - SQLi (CVE-2023-6360)

CVE-2023-6360 is an unauthenticated SQL injection vulnerability in the 'My Calendar' WordPress Plugin prior to version 3.4.22, affecting the 'from' and 'to' parameters in the '/my-calendar/v1/events' REST route. This flaw could allow remote attackers to execute arbitrary SQL commands against the database, potentially leading to data theft, unauthorized data modification, or full compromise of the affected WordPress site.

CrowdSec has been tracking this vulnerability and its exploits since 14th of May 2024.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2023-6360 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. In addition, according to the CrowdSec network, attack volume against CVE-2023-6360 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /my-calendar/v1/events endpoint by injecting SQL payloads into the from or to query parameters, allowing them to manipulate database queries and extract sensitive information from vulnerable WordPress installations.