[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2bpfySYimmlDijs-2QD1TGWx5u4lDnvqq2Wkv8jydOE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-27409","advanced-booking-appointment-system-webba-booking-calendar-missing-authorization","Advanced Booking & Appointment System – Webba Booking Calendar \u003C= 6.4.13 - Missing Authorization","The Advanced Booking & Appointment System – Webba Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.4.13. This makes it possible for unauthenticated attackers to perform an unauthorized action.","webba-booking-lite",null,"\u003C=6.4.13","6.4.14","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-01 00:00:00","2026-07-07 19:43:54",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb23de3eb-ae2a-4165-9251-7a135bc34b73?source=api-prod",7,[22,23,24,25],"includes\u002Fclass_wbk_backend.php","includes\u002Fclass_wbk_webba_connect.php","readme.txt","webba-booking-lite.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-27409\n\n## 1. Vulnerability Summary\nThe **Advanced Booking & Appointment System – Webba Booking Calendar** plugin (up to version 6.4.13) contains a missing authorization vulnerability. Multiple functions hooked to `template_redirect` and `admin_init` fail to perform capability checks (e.g., `current_user_can( 'manage_options' )`) or verify nonces before executing state-changing actions. This allows unauthenticated attackers to trigger sensitive operations, such as modifying plugin settings, rescheduling internal cron jobs, or manipulating third-party integrations (like Zoom).\n\n## 2. Attack Vector Analysis\n*   **Endpoints:** \n    *   WordPress Frontend (`\u002F`) via `template_redirect` hook.\n    *   WordPress Admin AJAX (`\u002Fwp-admin\u002Fadmin-ajax.php`) via `admin_init` hook.\n*   **Authentication:** Unauthenticated (No privileges required).\n*   **HTTP Parameters:**\n    *   `wbk_zoom_auth`: Triggers Zoom OAuth processing.\n    *   `code`: The authorization code passed to the integration handler.\n    *   `settings-updated`: Triggers post-update synchronization logic (e.g., cron rescheduling).\n*   **Preconditions:** The plugin must be active. For the Zoom-related vector, the `WBK_Zoom` class must be defined (included via `webba-booking-lite.php` based on PHP version and plan).\n\n## 3. Code Flow\nThe vulnerability manifests in two primary entry points:\n\n### Vector A: Zoom Integration Manipulation\n1.  **Entry Point:** `webba-booking-lite.php` registers `wbk_template_redirect` on the `template_redirect` hook.\n2.  **Trigger:** The function checks if `$_GET[\"wbk_zoom_auth\"]` and `$_GET[\"code\"]` are set.\n3.  **Vulnerable Path:**\n    ```php\n    function wbk_template_redirect() {\n        if ( isset( $_GET[\"wbk_zoom_auth\"] ) && isset( $_GET[\"code\"] ) ) {\n            if ( class_exists( \"WBK_Zoom\" ) ) {\n                $wbk_zoom = new WBK_Zoom();\n                $wbk_zoom->generate_access_token( $_GET[\"code\"] ); \u002F\u002F Sink: No Auth Check\n                wp_redirect( get_admin_url( null, \"admin.php?page=wbk-options&tab=wbk_zoom_settings_section\" ) );\n            }\n        }\n    }\n    ```\n4.  **Sink:** `WBK_Zoom::generate_access_token()` is called with user-controlled input. This typically performs a remote request to Zoom's API and updates the `wbk_zoom_access_token` and `wbk_zoom_refresh_token` options in the database.\n\n### Vector B: Unauthorized Cron\u002FAction Triggering\n1.  **Entry Point:** `includes\u002Fclass_wbk_backend.php` registers `handle_admin_redirects` on the `admin_init` hook.\n2.  **Trigger:** Any request to `wp-admin\u002Fadmin-ajax.php` (even unauthenticated) triggers `admin_init`.\n3.  **Vulnerable Path:** If `handle_admin_redirects` (or any logic it calls) invokes `settings_updated()` based on the `settings-updated` GET parameter:\n    ```php\n    public function settings_updated() {\n        if (isset($_GET[\"settings-updated\"]) && $_GET[\"settings-updated\"]) {\n            \u002F\u002F ... logic to calculate timestamps ...\n            wp_clear_scheduled_hook(\"wbk_daily_event\");\n            wp_schedule_event($timestamp, \"daily\", \"wbk_daily_event\"); \u002F\u002F Sink: No Auth Check\n        }\n    }\n    ```\n4.  **Sink:** `wp_schedule_event` is called, modifying the WordPress cron system.\n\n## 4. Nonce Acquisition Strategy\nBased on the source code analysis of the `template_redirect` and `admin_init` handlers:\n*   **No Nonce Required:** The `wbk_template_redirect` function and the `settings_updated` function **do not perform any nonce verification** (`check_admin_referer` or `wp_verify_nonce`) before execution.\n*   **Unauthenticated Access:** These hooks run before or during the initialization phase where standard WordPress admin protections are not yet enforced unless explicitly coded by the developer.\n\n## 5. Exploitation Strategy\n\n### Step 1: Trigger Zoom Token Manipulation\nThis attempt will try to force the plugin to process a malicious or dummy OAuth code, potentially overwriting existing integration credentials.\n\n*   **Tool:** `http_request`\n*   **Method:** `GET`\n*   **URL:** `https:\u002F\u002Ftarget.local\u002F?wbk_zoom_auth=1&code=dummy_expl","The Webba Booking Calendar plugin for WordPress is vulnerable to unauthorized access and potential configuration manipulation due to missing authorization and capability checks. Unauthenticated attackers can trigger sensitive actions such as rescheduling internal cron jobs or initiating OAuth token generation for Zoom integrations, while a lack of nonces in calendar management allows for CSRF-based revocation of Google and Outlook calendar connections.","\u002F\u002F webba-booking-lite.php line 143\nfunction wbk_template_redirect() {\n    if ( isset( $_GET[\"wbk_zoom_auth\"] ) && isset( $_GET[\"code\"] ) ) {\n        if ( class_exists( \"WBK_Zoom\" ) ) {\n            $wbk_zoom = new WBK_Zoom();\n            $wbk_zoom->generate_access_token( $_GET[\"code\"] );\n            wp_redirect( get_admin_url( null, \"admin.php?page=wbk-options&tab=wbk_zoom_settings_section\" ) );\n        }\n    }\n}\n\n---\n\n\u002F\u002F includes\u002Fclass_wbk_backend.php line 105\npublic function settings_updated()\n{\n    if (isset($_GET[\"settings-updated\"]) && $_GET[\"settings-updated\"]) {\n        date_default_timezone_set(get_option(\"wbk_timezone\", \"UTC\"));\n        $time_corr = intval(get_option(\"wbk_email_admin_daily_time\", \"68400\"));\n        $midnight = strtotime(\"today midnight\");\n        $timestamp = strtotime(\"today midnight\") + $time_corr;\n        if ($timestamp \u003C time()) {\n            $timestamp += 86400;\n        }\n        wp_clear_scheduled_hook(\"wbk_daily_event\");\n        wp_schedule_event($timestamp, \"daily\", \"wbk_daily_event\");\n        date_default_timezone_set(\"UTC\");\n    }\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.13\u002Fincludes\u002Fclass_wbk_backend.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.14\u002Fincludes\u002Fclass_wbk_backend.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.13\u002Fincludes\u002Fclass_wbk_backend.php\t2026-06-29 18:05:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.14\u002Fincludes\u002Fclass_wbk_backend.php\t2026-06-29 20:57:54.000000000 +0000\n@@ -349,6 +349,15 @@\n                 wp_die(\"You are not authorized to revoke Google Calendar tokens.\");\n             }\n             $calendar_id = intval($_GET[\"revoke-gg-calendar\"]);\n+            if (\n+                !isset($_GET[\"_wpnonce\"]) ||\n+                !wp_verify_nonce(\n+                    sanitize_text_field(wp_unslash($_GET[\"_wpnonce\"])),\n+                    \"wbk_revoke_gg_calendar_\" . $calendar_id,\n+                )\n+            ) {\n+                wp_die(\"Security check failed. Please try again.\");\n+            }\n             $google = new WBK_Google_Calendar_Processor($calendar_id);\n             $google->clear_access_token();\n \n@@ -365,6 +374,15 @@\n                 wp_die(\"You are not authorized to revoke Outlook Calendar tokens.\");\n             }\n             $calendar_id = intval($_GET[\"revoke-outlook-calendar\"]);\n+            if (\n+                !isset($_GET[\"_wpnonce\"]) ||\n+                !wp_verify_nonce(\n+                    sanitize_text_field(wp_unslash($_GET[\"_wpnonce\"])),\n+                    \"wbk_revoke_outlook_calendar_\" . $calendar_id,\n+                )\n+            ) {\n+                wp_die(\"Security check failed. Please try again.\");\n+            }\n             $outlook = new WBK_Outlook_Calendar_Processor($calendar_id);\n             $outlook->clear_access_token();\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.13\u002Fincludes\u002Fclass_wbk_webba_connect.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.14\u002Fincludes\u002Fclass_wbk_webba_connect.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.13\u002Fincludes\u002Fclass_wbk_webba_connect.php\t2026-03-06 14:56:28.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebba-booking-lite\u002F6.4.14\u002Fincludes\u002Fclass_wbk_webba_connect.php\t2026-06-29 20:57:54.000000000 +0000\n@@ -219,7 +219,10 @@\n     public function get_google_revoke_url($calendar_id = \"\")\n     {\n         $return_path =\n-\t    \"\u002Fwp-admin\u002Fadmin.php?page=wbk-connected-calendars&revoke-gg-calendar=\" . $calendar_id;\n+\t    \"\u002Fwp-admin\u002Fadmin.php?page=wbk-connected-calendars&revoke-gg-calendar=\" .\n+\t    $calendar_id .\n+\t    \"&_wpnonce=\" .\n+\t    wp_create_nonce(\"wbk_revoke_gg_calendar_\" . $calendar_id);\n \n         \u002F\u002F Prepare authentication parameters including HMAC validation\n         $query = $this->prepare_auth_parameters($return_path, \"revoke-token\", $calendar_id);\n@@ -372,7 +375,9 @@\n     {\n         $return_path =\n             \"\u002Fwp-admin\u002Fadmin.php?page=wbk-connected-calendars&revoke-outlook-calendar=\" .\n-\t    $calendar_id;\n+\t    $calendar_id .\n+\t    \"&_wpnonce=\" .\n+\t    wp_create_nonce(\"wbk_revoke_outlook_calendar_\" . $calendar_id);\n \n         \u002F\u002F Prepare authentication parameters including HMAC validation\n         $query = $this->prepare_auth_parameters($return_path, \"revoke-token\", $calendar_id);","The exploit target endpoints hooked via `template_redirect` and `admin_init` which lack standard authorization checks. 1. Zoom Integration Overwrite: An unauthenticated attacker can send a GET request to the site homepage with the parameters `wbk_zoom_auth=1` and `code=[DUMMY_CODE]`, forcing the plugin to process a malicious or invalid OAuth code and potentially breaking the site's Zoom integration. 2. Cron Job Rescheduling: An attacker can send a request to `wp-admin\u002Fadmin-ajax.php` with the GET parameter `settings-updated=1` to trigger a re-scheduling of the `wbk_daily_event` cron hook, which could lead to unauthorized system state changes or denial of service by manipulating background task timings. 3. Unauthorized Calendar Revocation: By exploiting the lack of nonces in the `revoke-gg-calendar` and `revoke-outlook-calendar` logic, an attacker can craft a CSRF payload to disconnect an administrator's Google or Outlook calendar integrations.","gemini-3-flash-preview","2026-07-25 12:06:16","2026-07-25 12:08:03",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","6.4.13","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwebba-booking-lite\u002Ftags\u002F6.4.13","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwebba-booking-lite.6.4.13.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwebba-booking-lite\u002Ftags\u002F6.4.14","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwebba-booking-lite.6.4.14.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwebba-booking-lite\u002Ftags"]