Exploitation Research Plan: CVE-2026-57395 (Tourfic Plugin)

1. Vulnerability Summary

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress (versions <= 2.22.5) contains a Missing Authorization vulnerability. The plugin registers several AJAX handlers intended for administrative use (such as API key management or data duplication) but fails to implement a capability check (e.g., current_user_can('manage_options')) within the handler functions.

While these handlers are protected by WordPress nonces to prevent CSRF, the nonces are often accessible to any authenticated user (including the customer role). Consequently, a low-privileged user can obtain a valid nonce and invoke these administrative actions to modify plugin settings or generate API credentials.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: tf_generate_api_key (identified from tourfic-admin-api.min.js)
• Alternative Action: tf_duplicate_post_data (identified from tourfic-admin-scripts.min.js)
• Authentication: Authenticated (customer role and above).
• Payload Parameter: action, nonce, and action-specific fields (e.g., name for the key).
• Preconditions: The attacker must be logged in as a user with the customer role (common in WooCommerce/Booking sites).

3. Code Flow

1. The plugin registers the AJAX handler in its main class or an admin include file using add_action('wp_ajax_tf_generate_api_key', '...').
2. The handler function likely begins with check_ajax_referer('tf_api_nonce', 'nonce') (or similar) to validate the request origin.
3. Vulnerability: The function proceeds to generate an API key and save it to the database/options table without calling current_user_can('manage_options').
4. Because the customer role is an authenticated role, the wp_ajax_ hook triggers successfully.

4. Nonce Acquisition Strategy

To exploit tf_generate_api_key, we need the nonce localized in window.tfApiDocs. This is likely enqueued on pages where the Tourfic API documentation or settings are visible.

1. Identify Target Page: The scripts are likely loaded on the Tourfic Settings page in the dashboard. If the customer role has access to any Tourfic-related frontend dashboard (e.g., vendor dashboard), the scripts may load there.
2. Setup Page (if needed): If the nonce is not appearing on the standard user profile, we can attempt to find a shortcode that enqueues the admin API scripts. Based on the file name tourfic-admin-api.min.js, it is strictly an admin-side script.
3. Browser Extraction:
   • Log in as a customer.
   • Navigate to /wp-admin/index.php (WordPress Dashboard). Many plugins enqueue global scripts here.
   • Use the following JS in browser_eval to extract the nonce:

     // Based on assets/admin/js/tourfic-admin-api.min.js
     window.tfApiDocs?.nonce || "Not Found"
     

   • If that is not found, check for the general admin nonce:

     // Based on assets/admin/js/tourfic-admin-scripts.min.js
     tf_admin_params?.tf_nonce || "Not Found"
     

5. Exploitation Strategy

We will attempt to generate a new API key for the plugin, which could grant external access to booking data.

Request: Generate API Key

• Tool: http_request
• Method: POST
• URL: {{base_url}}/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=tf_generate_api_key&nonce={{extracted_nonce}}&name=ExploitKey
  

Request: Duplicate Post (Alternative)

If API generation fails, we can attempt to duplicate a post (hotel/tour) to clutter the database or potentially modify content.

• Body:

  action=tf_duplicate_post_data&postID=1&postType=tf_hotel&security={{extracted_tf_nonce}}
  

  (Note: security is the parameter name used for the nonce in the tf_duplicate_post_data handler according to tourfic-admin-scripts.min.js).

6. Test Data Setup

1. Plugin Installation: Install and activate Tourfic <= 2.22.5.
2. User Creation: Create a user with the customer role:
   wp user create attacker attacker@example.com --role=customer --user_pass=password123
3. Content Creation: Create a dummy Hotel post to test duplication:
   wp post create --post_type=tf_hotel --post_title="Victim Hotel" --post_status=publish

7. Expected Results

• Response Code: 200 OK
• Response Body: A JSON object containing success: true. If tf_generate_api_key is successful, it should return a list of API keys or a confirmation.
• Impact: A new API key entry is created in the WordPress database, which should only be possible for Administrators.

8. Verification Steps

1. Check Options: Check if the API key exists in the plugin's storage (likely an option or a custom table):
   wp option get tf_api_keys (inferred name)
2. Verify Post Duplication: If the duplication exploit was used:
   wp post list --post_type=tf_hotel
   Check if a second "Victim Hotel" or "Victim Hotel (Copy)" exists.

9. Alternative Approaches

• Affiliate Activation: Attempt to activate the affiliate system via action: "tf_affiliate_active".
• Status Change: Attempt to change a ticket status via action: "tf_ticket_status_change" and order_unique_id=1. This would impact the business logic of car rentals or hotel check-ins.
• Parameter Fuzzing: If the name parameter in tf_generate_api_key is actually passed into a SQL query without sanitization (unlikely but possible), this could lead to SQL Injection. Use the http_request tool to test ' in the name field.