Exploitation Research Plan - CVE-2026-9188 (Wappointment)

1. Vulnerability Summary

The Wappointment plugin (<= 2.7.6) for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in its unauthenticated appointment management functionality. The authorization token (edit_key / appointmentkey) used to validate requests for cancelling or rescheduling appointments is generated using a predictable, unsalted MD5 hash of three enumerable or observable values: the client_id (sequential integer), the appointment start_at (Unix timestamp), and the staff_id (small enumerable integer). Because no secret salt or cryptographically secure random component is included in the hash, an unauthenticated attacker can reconstruct the valid key for any appointment and perform unauthorized actions.

2. Attack Vector Analysis

• Endpoint: WordPress REST API endpoint used for appointment cancellation.
  • Path: /wp-json/wappointment/v1/appointment/cancel (inferred from Wappointment REST naming conventions).
• HTTP Method: POST
• Vulnerable Parameter: appointmentkey (maps to edit_key in the database).
• Identity Parameter: id (the sequential appointment_id).
• Authentication: None (Unauthenticated).
• Preconditions:
  • The setting "Allow clients to cancel and reschedule appointments" must be enabled (Wappointment > Settings > General).
  • The attacker must know or guess the victim's appointment_id, client_id, and start_at timestamp.

3. Code Flow

1. Key Generation (Creation Phase):
   • When an appointment is created, Wappointment\Models\Client::generateEditKey($start_at) or Wappointment\Models\Appointment\Recurrence::generateEditKey() is called.
   • Based on app/Models/Appointment/Recurrence.php, the key is generated as:
     md5($timestamp . $staff_id)
   • Based on the vulnerability description and app/Models/Client.php, the broader key construction used for standard bookings is:
     md5($client_id . $start_at . $staff_id) (or similar sequential concatenation).
2. Access Control (Action Phase):
   • A request is sent to the cancellation endpoint (e.g., POST /wp-json/wappointment/v1/appointment/cancel).
   • The request is handled by a controller that calls tryCancel().
   • tryCancel() retrieves the appointment by id and compares the provided appointmentkey against the edit_key stored in the database.
   • If they match, the appointment is cancelled without further identity verification.

4. Nonce Acquisition Strategy

This specific REST endpoint is designed for unauthenticated users (e.g., clicking a link in a confirmation email) and typically does not require a WordPress CSRF nonce (_wpnonce) if configured as a public REST route.

However, if a nonce is required for the wp-json API generally:

1. Identify the shortcode: [wappointment_form] (common for this plugin).
2. Create a public page: wp post create --post_type=page --post_status=publish --post_content='[wappointment_form]'
3. Navigate to the page and use browser_eval to extract the REST nonce usually localized by WordPress or the plugin:
   browser_eval("window.wpApiSettings?.nonce || window.wappointment_data?.nonce")

5. Exploitation Strategy

Step 1: Reconnaissance (Sequential ID Discovery)

1. As the attacker, book a "probe" appointment.
2. Note the returned appointment_id (e.g., 105) and client_id (e.g., 50).
3. Observe the public booking calendar to find a victim's booked slot. Note the date/time (e.g., 2023-11-20 10:00:00).

Step 2: Key Reconstruction

1. Predict client_id: If the attacker's ID was 50, and the victim booked shortly after, the victim's client_id is likely 51.
2. Determine start_at: Convert the observed appointment time to a Unix timestamp.
   • 2023-11-20 10:00:00 -> 1700474400.
3. Determine staff_id: Usually 1 for single-user setups, or enumerable via the booking form's staff selection dropdown.
4. Compute MD5: echo -n "5117004744001" | md5sum (assuming client_id . start_at . staff_id).

Step 3: Payload Delivery

Send the cancellation request using http_request.

{
  "method": "POST",
  "url": "http://vulnerable-site.com/wp-json/wappointment/v1/appointment/cancel",
  "headers": {
    "Content-Type": "application/json"
  },
  "body": "{\"id\": 106, \"appointmentkey\": \"[RECONSTRUCTED_MD5]\"}"
}

6. Test Data Setup

1. Configure Plugin:
   • Install Wappointment 2.7.6.
   • Create a Service and a Staff member (staff_id 1).
   • Enable cancellations in Wappointment > Settings > General.
2. Create Victim Data:
   • Perform a booking as "Victim" (e.g., via the frontend form) for a specific time.
   • Record the appointment_id and client_id from the database to verify the attacker's "prediction".
3. Create Attacker Data:
   • Perform a booking as "Attacker" to establish the sequential ID baseline.

7. Expected Results

• Success: The server returns a 200 OK with a JSON response indicating success (e.g., {"success": true, "message": "Appointment cancelled"}).
• Database Impact: The appointment record in the wappo_appointments table will have its status updated to cancelled (or the record will be soft-deleted).

8. Verification Steps

1. Check via WP-CLI:

   wp db query "SELECT status FROM wp_wappo_appointments WHERE id = 106"
   

   Confirm the status is no longer confirmed or pending.
2. UI Verification: Check the Wappointment admin dashboard; the victim's appointment should appear as cancelled or disappear from the active list.

9. Alternative Approaches

If md5(client_id . start_at . staff_id) fails:

1. Try md5(start_at . staff_id) (as seen in Recurrence.php).
2. Try md5(client_id . start_at) (as seen in Client.php).
3. Brute-force the client_id (since it's a small sequential integer) by iterating through Attacker_Client_ID +/- 10 and sending requests for each. Since the hash is MD5 and the inputs are known, this is highly feasible.