[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQ3rFpeC4IUC5MPR_9CdRQekbJY9mhJ_KLSZOfjiE2uk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57395","tourfic-ai-powered-travel-booking-hotel-booking-car-rental-wordpress-plugin-missing-authorization-2","Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin \u003C= 2.22.5 - Missing Authorization","The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.22.5. This makes it possible for authenticated attackers, with customer-level access and above, to perform an unauthorized action.","tourfic",null,"\u003C=2.22.5","2.22.6","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:45:05",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F494168ab-83d1-4a26-a61d-a02509147890?source=api-prod",7,[22,23,24,25,26,27,28,29],"assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.css","assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.css.map","assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.min.css","assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.min.css.map","assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-api.min.js","assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-scripts.min.js","assets\u002Fapp\u002Fcss\u002Ftourfic-carrentals.css","assets\u002Fapp\u002Fcss\u002Ftourfic-carrentals.min.css","researched",false,3,"# Exploitation Research Plan: CVE-2026-57395 (Tourfic Plugin)\n\n## 1. Vulnerability Summary\nThe **Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental** plugin for WordPress (versions \u003C= 2.22.5) contains a **Missing Authorization** vulnerability. The plugin registers several AJAX handlers intended for administrative use (such as API key management or data duplication) but fails to implement a capability check (e.g., `current_user_can('manage_options')`) within the handler functions. \n\nWhile these handlers are protected by WordPress nonces to prevent CSRF, the nonces are often accessible to any authenticated user (including the `customer` role). Consequently, a low-privileged user can obtain a valid nonce and invoke these administrative actions to modify plugin settings or generate API credentials.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Vulnerable Action:** `tf_generate_api_key` (identified from `tourfic-admin-api.min.js`)\n*   **Alternative Action:** `tf_duplicate_post_data` (identified from `tourfic-admin-scripts.min.js`)\n*   **Authentication:** Authenticated (`customer` role and above).\n*   **Payload Parameter:** `action`, `nonce`, and action-specific fields (e.g., `name` for the key).\n*   **Preconditions:** The attacker must be logged in as a user with the `customer` role (common in WooCommerce\u002FBooking sites).\n\n## 3. Code Flow\n1.  The plugin registers the AJAX handler in its main class or an admin include file using `add_action('wp_ajax_tf_generate_api_key', '...')`.\n2.  The handler function likely begins with `check_ajax_referer('tf_api_nonce', 'nonce')` (or similar) to validate the request origin.\n3.  **Vulnerability:** The function proceeds to generate an API key and save it to the database\u002Foptions table without calling `current_user_can('manage_options')`.\n4.  Because the `customer` role is an authenticated role, the `wp_ajax_` hook triggers successfully.\n\n## 4. Nonce Acquisition Strategy\nTo exploit `tf_generate_api_key`, we need the nonce localized in `window.tfApiDocs`. This is likely enqueued on pages where the Tourfic API documentation or settings are visible.\n\n1.  **Identify Target Page:** The scripts are likely loaded on the Tourfic Settings page in the dashboard. If the `customer` role has access to any Tourfic-related frontend dashboard (e.g., vendor dashboard), the scripts may load there.\n2.  **Setup Page (if needed):** If the nonce is not appearing on the standard user profile, we can attempt to find a shortcode that enqueues the admin API scripts. Based on the file name `tourfic-admin-api.min.js`, it is strictly an admin-side script.\n3.  **Browser Extraction:**\n    *   Log in as a `customer`.\n    *   Navigate to `\u002Fwp-admin\u002Findex.php` (WordPress Dashboard). Many plugins enqueue global scripts here.\n    *   Use the following JS in `browser_eval` to extract the nonce:\n        ```javascript\n        \u002F\u002F Based on assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-api.min.js\n        window.tfApiDocs?.nonce || \"Not Found\"\n        ```\n    *   If that is not found, check for the general admin nonce:\n        ```javascript\n        \u002F\u002F Based on assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-scripts.min.js\n        tf_admin_params?.tf_nonce || \"Not Found\"\n        ```\n\n## 5. Exploitation Strategy\nWe will attempt to generate a new API key for the plugin, which could grant external access to booking data.\n\n### Request: Generate API Key\n*   **Tool:** `http_request`\n*   **Method:** `POST`\n*   **URL:** `{{base_url}}\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```text\n    action=tf_generate_api_key&nonce={{extracted_nonce}}&name=ExploitKey\n    ```\n\n### Request: Duplicate Post (Alternative)\nIf API generation fails, we can attempt to duplicate a post (hotel\u002Ftour) to clutter the database or potentially modify content.\n*   **Body:**\n    ```text\n    action=tf_duplicate_post_data&postID=1&postType=tf_hotel&security={{extracted_tf_nonce}}\n    ```\n    *(Note: `security` is the parameter name used for the nonce in the `tf_duplicate_post_data` handler according to `tourfic-admin-scripts.min.js`)*.\n\n## 6. Test Data Setup\n1.  **Plugin Installation:** Install and activate Tourfic \u003C= 2.22.5.\n2.  **User Creation:** Create a user with the `customer` role:\n    `wp user create attacker attacker@example.com --role=customer --user_pass=password123`\n3.  **Content Creation:** Create a dummy Hotel post to test duplication:\n    `wp post create --post_type=tf_hotel --post_title=\"Victim Hotel\" --post_status=publish`\n\n## 7. Expected Results\n*   **Response Code:** `200 OK`\n*   **Response Body:** A JSON object containing `success: true`. If `tf_generate_api_key` is successful, it should return a list of API keys or a confirmation.\n*   **Impact:** A new API key entry is created in the WordPress database, which should only be possible for Administrators.\n\n## 8. Verification Steps\n1.  **Check Options:** Check if the API key exists in the plugin's storage (likely an option or a custom table):\n    `wp option get tf_api_keys` (inferred name)\n2.  **Verify Post Duplication:** If the duplication exploit was used:\n    `wp post list --post_type=tf_hotel`\n    *Check if a second \"Victim Hotel\" or \"Victim Hotel (Copy)\" exists.*\n\n## 9. Alternative Approaches\n*   **Affiliate Activation:** Attempt to activate the affiliate system via `action: \"tf_affiliate_active\"`.\n*   **Status Change:** Attempt to change a ticket status via `action: \"tf_ticket_status_change\"` and `order_unique_id=1`. This would impact the business logic of car rentals or hotel check-ins.\n*   **Parameter Fuzzing:** If the `name` parameter in `tf_generate_api_key` is actually passed into a SQL query without sanitization (unlikely but possible), this could lead to SQL Injection. Use the `http_request` tool to test `'` in the `name` field.","The Tourfic plugin for WordPress fails to implement proper authorization checks on several AJAX handlers, such as those for generating API keys and duplicating posts. This allows authenticated attackers with customer-level access to perform administrative actions, provided they can obtain a valid security nonce which is often localized in the dashboard.","\u002F\u002F Inferred from Research Plan and AJAX registration patterns\n\u002F\u002F Typically found in an administrative or AJAX handler file\n\nadd_action('wp_ajax_tf_generate_api_key', 'tf_generate_api_key_callback');\n\nfunction tf_generate_api_key_callback() {\n    \u002F\u002F Vulnerability: Missing current_user_can() check\n    check_ajax_referer('tf_api_nonce', 'nonce');\n    \n    $name = sanitize_text_field($_POST['name']);\n    \u002F\u002F ... logic to generate and save API key ...\n    wp_send_json_success($generated_key);\n}\n\n---\n\nadd_action('wp_ajax_tf_duplicate_post_data', 'tf_duplicate_post_data_callback');\n\nfunction tf_duplicate_post_data_callback() {\n    \u002F\u002F Vulnerability: Missing capability check before administrative action\n    check_ajax_referer('tf_duplicate_nonce', 'security');\n\n    $post_id = intval($_POST['postID']);\n    \u002F\u002F ... logic to duplicate post ...\n    wp_send_json_success();\n}","--- a\u002Finc\u002Fadmin\u002Ffunctions.php\n+++ b\u002Finc\u002Fadmin\u002Ffunctions.php\n@@ -10,6 +10,10 @@\n function tf_generate_api_key_callback() {\n \tcheck_ajax_referer( 'tf_api_nonce', 'nonce' );\n \n+\tif ( ! current_user_can( 'manage_options' ) ) {\n+\t\twp_send_json_error( array( 'message' => __( 'Permission denied', 'tourfic' ) ) );\n+\t}\n+\n \t$name = sanitize_text_field( $_POST['name'] );\n \t\u002F\u002F ... existing logic ...\n }\n@@ -25,6 +29,10 @@\n function tf_duplicate_post_data_callback() {\n \tcheck_ajax_referer( 'tf_duplicate_nonce', 'security' );\n \n+\tif ( ! current_user_can( 'manage_options' ) ) {\n+\t\twp_send_json_error( array( 'message' => __( 'Permission denied', 'tourfic' ) ) );\n+\t}\n+\n \t$post_id = intval( $_POST['postID'] );\n \t\u002F\u002F ... existing logic ...\n }","The exploit targets the AJAX interface of WordPress. An attacker first logs into a low-privileged account (such as a 'customer' role). By inspecting localized scripts on the WordPress dashboard (e.g., window.tfApiDocs or tf_admin_params), the attacker extracts the necessary security nonces (tf_api_nonce or tf_nonce). The attacker then sends a POST request to \u002Fwp-admin\u002Fadmin-ajax.php with the 'action' parameter set to 'tf_generate_api_key' or 'tf_duplicate_post_data' and includes the stolen nonce. Because the plugin lacks a capability check like current_user_can('manage_options'), the server executes the administrative command on behalf of the low-privileged user.","gemini-3-flash-preview","2026-07-25 08:08:45","2026-07-25 08:09:47",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.22.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftourfic\u002Ftags\u002F2.22.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftourfic.2.22.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftourfic\u002Ftags\u002F2.22.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftourfic.2.22.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftourfic\u002Ftags"]