WP-Safety
CVE-2026-27409

Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 - Missing Authorization

mediumMissing Authorization
5.3
CVSS Score
5.3
CVSS Score
medium
Severity
6.4.14
Patched in
7d
Time to patch

Description

The Advanced Booking & Appointment System – Webba Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.4.13. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=6.4.13
PublishedJuly 1, 2026
Last updatedJuly 7, 2026
Affected pluginwebba-booking-lite

What Changed in the Fix

Changes introduced in v6.4.14

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v6.4.13
Browse source Download .zip
Patched v6.4.14
Browse source Download .zip
Research Plan
Unverified

# Exploitation Research Plan - CVE-2026-27409 ## 1. Vulnerability Summary The **Advanced Booking & Appointment System – Webba Booking Calendar** plugin (up to version 6.4.13) contains a missing authorization vulnerability. Multiple functions hooked to `template_redirect` and `admin_init` fail to pe…

Show full research plan

Exploitation Research Plan - CVE-2026-27409

1. Vulnerability Summary

The Advanced Booking & Appointment System – Webba Booking Calendar plugin (up to version 6.4.13) contains a missing authorization vulnerability. Multiple functions hooked to template_redirect and admin_init fail to perform capability checks (e.g., current_user_can( 'manage_options' )) or verify nonces before executing state-changing actions. This allows unauthenticated attackers to trigger sensitive operations, such as modifying plugin settings, rescheduling internal cron jobs, or manipulating third-party integrations (like Zoom).

2. Attack Vector Analysis

  • Endpoints:
    • WordPress Frontend (/) via template_redirect hook.
    • WordPress Admin AJAX (/wp-admin/admin-ajax.php) via admin_init hook.
  • Authentication: Unauthenticated (No privileges required).
  • HTTP Parameters:
    • wbk_zoom_auth: Triggers Zoom OAuth processing.
    • code: The authorization code passed to the integration handler.
    • settings-updated: Triggers post-update synchronization logic (e.g., cron rescheduling).
  • Preconditions: The plugin must be active. For the Zoom-related vector, the WBK_Zoom class must be defined (included via webba-booking-lite.php based on PHP version and plan).

3. Code Flow

The vulnerability manifests in two primary entry points:

Vector A: Zoom Integration Manipulation

  1. Entry Point: webba-booking-lite.php registers wbk_template_redirect on the template_redirect hook.
  2. Trigger: The function checks if $_GET["wbk_zoom_auth"] and $_GET["code"] are set.
  3. Vulnerable Path:
    function wbk_template_redirect() {
    if ( isset( $_GET["wbk_zoom_auth"] ) && isset( $_GET["code"] ) ) {
        if ( class_exists( "WBK_Zoom" ) ) {
            $wbk_zoom = new WBK_Zoom();
            $wbk_zoom->generate_access_token( $_GET["code"] ); // Sink: No Auth Check
            wp_redirect( get_admin_url( null, "admin.php?page=wbk-options&tab=wbk_zoom_settings_section" ) );
        }
    }
}
  4. Sink: WBK_Zoom::generate_access_token() is called with user-controlled input. This typically performs a remote request to Zoom's API and updates the wbk_zoom_access_token and wbk_zoom_refresh_token options in the database.

Vector B: Unauthorized Cron/Action Triggering

  1. Entry Point: includes/class_wbk_backend.php registers handle_admin_redirects on the admin_init hook.
  2. Trigger: Any request to wp-admin/admin-ajax.php (even unauthenticated) triggers admin_init.
  3. Vulnerable Path: If handle_admin_redirects (or any logic it calls) invokes settings_updated() based on the settings-updated GET parameter:
    public function settings_updated() {
    if (isset($_GET["settings-updated"]) && $_GET["settings-updated"]) {
        // ... logic to calculate timestamps ...
        wp_clear_scheduled_hook("wbk_daily_event");
        wp_schedule_event($timestamp, "daily", "wbk_daily_event"); // Sink: No Auth Check
    }
}
  4. Sink: wp_schedule_event is called, modifying the WordPress cron system.

4. Nonce Acquisition Strategy

Based on the source code analysis of the template_redirect and admin_init handlers:

  • No Nonce Required: The wbk_template_redirect function and the settings_updated function do not perform any nonce verification (check_admin_referer or wp_verify_nonce) before execution.
  • Unauthenticated Access: These hooks run before or during the initialization phase where standard WordPress admin protections are not yet enforced unless explicitly coded by the developer.

5. Exploitation Strategy

Step 1: Trigger Zoom Token Manipulation

This attempt will try to force the plugin to process a malicious or dummy OAuth code, potentially overwriting existing integration credentials.

Research Findings
Static analysis — not yet PoC-verified

Summary

The Webba Booking Calendar plugin for WordPress is vulnerable to unauthorized access and potential configuration manipulation due to missing authorization and capability checks. Unauthenticated attackers can trigger sensitive actions such as rescheduling internal cron jobs or initiating OAuth token generation for Zoom integrations, while a lack of nonces in calendar management allows for CSRF-based revocation of Google and Outlook calendar connections.

Vulnerable Code

// webba-booking-lite.php line 143
function wbk_template_redirect() {
    if ( isset( $_GET["wbk_zoom_auth"] ) && isset( $_GET["code"] ) ) {
        if ( class_exists( "WBK_Zoom" ) ) {
            $wbk_zoom = new WBK_Zoom();
            $wbk_zoom->generate_access_token( $_GET["code"] );
            wp_redirect( get_admin_url( null, "admin.php?page=wbk-options&tab=wbk_zoom_settings_section" ) );
        }
    }
}

---

// includes/class_wbk_backend.php line 105
public function settings_updated()
{
    if (isset($_GET["settings-updated"]) && $_GET["settings-updated"]) {
        date_default_timezone_set(get_option("wbk_timezone", "UTC"));
        $time_corr = intval(get_option("wbk_email_admin_daily_time", "68400"));
        $midnight = strtotime("today midnight");
        $timestamp = strtotime("today midnight") + $time_corr;
        if ($timestamp < time()) {
            $timestamp += 86400;
        }
        wp_clear_scheduled_hook("wbk_daily_event");
        wp_schedule_event($timestamp, "daily", "wbk_daily_event");
        date_default_timezone_set("UTC");
    }
}

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.13/includes/class_wbk_backend.php /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.14/includes/class_wbk_backend.php
--- /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.13/includes/class_wbk_backend.php	2026-06-29 18:05:08.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.14/includes/class_wbk_backend.php	2026-06-29 20:57:54.000000000 +0000
@@ -349,6 +349,15 @@
                 wp_die("You are not authorized to revoke Google Calendar tokens.");
             }
             $calendar_id = intval($_GET["revoke-gg-calendar"]);
+            if (
+                !isset($_GET["_wpnonce"]) ||
+                !wp_verify_nonce(
+                    sanitize_text_field(wp_unslash($_GET["_wpnonce"])),
+                    "wbk_revoke_gg_calendar_" . $calendar_id,
+                )
+            ) {
+                wp_die("Security check failed. Please try again.");
+            }
             $google = new WBK_Google_Calendar_Processor($calendar_id);
             $google->clear_access_token();
 
@@ -365,6 +374,15 @@
                 wp_die("You are not authorized to revoke Outlook Calendar tokens.");
             }
             $calendar_id = intval($_GET["revoke-outlook-calendar"]);
+            if (
+                !isset($_GET["_wpnonce"]) ||
+                !wp_verify_nonce(
+                    sanitize_text_field(wp_unslash($_GET["_wpnonce"])),
+                    "wbk_revoke_outlook_calendar_" . $calendar_id,
+                )
+            ) {
+                wp_die("Security check failed. Please try again.");
+            }
             $outlook = new WBK_Outlook_Calendar_Processor($calendar_id);
             $outlook->clear_access_token();
 
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.13/includes/class_wbk_webba_connect.php /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.14/includes/class_wbk_webba_connect.php
--- /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.13/includes/class_wbk_webba_connect.php	2026-03-06 14:56:28.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/webba-booking-lite/6.4.14/includes/class_wbk_webba_connect.php	2026-06-29 20:57:54.000000000 +0000
@@ -219,7 +219,10 @@
     public function get_google_revoke_url($calendar_id = "")
     {
         $return_path =
-	    "/wp-admin/admin.php?page=wbk-connected-calendars&revoke-gg-calendar=" . $calendar_id;
+	    "/wp-admin/admin.php?page=wbk-connected-calendars&revoke-gg-calendar=" .
+	    $calendar_id .
+	    "&_wpnonce=" .
+	    wp_create_nonce("wbk_revoke_gg_calendar_" . $calendar_id);
 
         // Prepare authentication parameters including HMAC validation
         $query = $this->prepare_auth_parameters($return_path, "revoke-token", $calendar_id);
@@ -372,7 +375,9 @@
     {
         $return_path =
             "/wp-admin/admin.php?page=wbk-connected-calendars&revoke-outlook-calendar=" .
-	    $calendar_id;
+	    $calendar_id .
+	    "&_wpnonce=" .
+	    wp_create_nonce("wbk_revoke_outlook_calendar_" . $calendar_id);
 
         // Prepare authentication parameters including HMAC validation
         $query = $this->prepare_auth_parameters($return_path, "revoke-token", $calendar_id);

Exploit Outline

The exploit target endpoints hooked via `template_redirect` and `admin_init` which lack standard authorization checks. 1. Zoom Integration Overwrite: An unauthenticated attacker can send a GET request to the site homepage with the parameters `wbk_zoom_auth=1` and `code=[DUMMY_CODE]`, forcing the plugin to process a malicious or invalid OAuth code and potentially breaking the site's Zoom integration. 2. Cron Job Rescheduling: An attacker can send a request to `wp-admin/admin-ajax.php` with the GET parameter `settings-updated=1` to trigger a re-scheduling of the `wbk_daily_event` cron hook, which could lead to unauthorized system state changes or denial of service by manipulating background task timings. 3. Unauthorized Calendar Revocation: By exploiting the lack of nonces in the `revoke-gg-calendar` and `revoke-outlook-calendar` logic, an attacker can craft a CSRF payload to disconnect an administrator's Google or Outlook calendar integrations.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/b23de3eb-ae2a-4165-9251-7a135bc34b73?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database