Booking Package <= 1.7.06 - Missing Authorization

This plan outlines the steps to verify the Missing Authorization vulnerability (CVE-2026-40774) in the Booking Package plugin. The vulnerability allows unauthenticated attackers to perform unauthorized actions, likely related to booking management (e.g., cancellation), due to insufficient permission checks in the public AJAX handler.

1. Vulnerability Summary

• Vulnerability: Missing Authorization
• Affected Component: package_app_public_action AJAX handler in index.php.
• Impact: Unauthenticated integrity impact (I:L). Attackers can perform actions such as canceling bookings belonging to other users.
• Root Cause: The function registered under wp_ajax_nopriv_package_app_public_action dispatches requests to various internal functions (via the function parameter) without verifying if the requester has authority over the specific resource (e.g., booking_id).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: package_app_public_action (unauthenticated AJAX).
• Method: POST
• Key Parameters:
  • action: package_app_public_action
  • function: The specific internal action to perform (e.g., cancel_booking).
  • booking_id: The target booking identifier to modify.
  • nonce: A valid nonce for the public action.
• Preconditions: A booking must exist in the system, and its ID must be known or guessed.

3. Code Flow

1. Entry Point: The plugin registers a public AJAX handler in index.php:
   add_action('wp_ajax_nopriv_' . $this->action_public, array($this, 'package_app_public_action')); where $this->action_public is package_app_public_action.
2. Dispatching: The package_app_public_action() function (in index.php) retrieves the function parameter from $_POST.
3. Vulnerable Branch: When function is set to a sensitive value (like cancel_booking), the code proceeds to perform the operation.
4. Missing Check: The code fails to call current_user_can() or compare the booking's owner/token against the current requester's session before calling the cancellation logic in lib/Schedule.php or lib/Database.php.

4. Nonce Acquisition Strategy

The plugin enqueues a script that localizes a reservation_info object containing the required nonce.

1. Identify Shortcode: The [booking_package id=1] shortcode (referenced in lib/Documents.php) enqueues the necessary scripts.
2. Create Test Page:

   wp post create --post_type=page --post_title="Booking Page" --post_status=publish --post_content='[booking_package id=1]'
   

3. Extract Nonce:
   • Navigate to the newly created page.
   • Execute JS to retrieve the nonce from the reservation_info global object.
   • Variable: window.reservation_info?.nonce (based on js/Booking_app.js references).

5. Exploitation Strategy

Step 1: Obtain a valid Booking ID
First, create a booking in the system to target. We will use the booking_id of this test booking.

Step 2: Extract Nonce
Use the browser_navigate and browser_eval tools to grab the nonce from the reservation_info object on the page containing the shortcode.

Step 3: Execute Unauthorized Action (Cancellation)
Send a POST request to admin-ajax.php to cancel the booking.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=package_app_public_action&function=cancel_booking&booking_id=[TARGET_ID]&nonce=[EXTRACTED_NONCE]
  

  (Note: If cancel_booking fails, alternative function names to try based on plugin structure: cancel_booking_visitor, delete_booking, update_booking_status)

6. Test Data Setup

1. Initialize Calendar: Ensure at least one calendar exists.

   # Create a basic calendar entry via SQL if not present
   wp db query "INSERT INTO wp_booking_package_calendar (title, location, summary) VALUES ('Test Calendar', 'Online', 'Test Summary')"
   

2. Create a Page:

   wp post create --post_type=page --post_status=publish --post_content='[booking_package id=1]'
   

3. Create a Target Booking:

   # Insert a dummy booking into the database
   wp db query "INSERT INTO wp_booking_package_booking (calendar_id, status, last_name, first_name, email) VALUES (1, 'approved', 'Target', 'User', 'target@example.com')"
   # Get the ID
   TARGET_ID=$(wp db query "SELECT id FROM wp_booking_package_booking WHERE last_name='Target' ORDER BY id DESC LIMIT 1" --silent --skip-column-names)
   

7. Expected Results

• The AJAX response should return a success message or a JSON status indicating the booking was updated/canceled.
• The response code should be 200 OK.
• The wp_booking_package_booking table entry for the TARGET_ID should have its status changed to canceled (or the entry should be deleted, depending on the specific function logic).

8. Verification Steps

1. Check Database State:

   wp db query