[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMoFUrlM5guXSMKBJaXYRmQ-qTSuxY_GICMZzt97njZY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":36},"CVE-2026-57723","vikbooking-hotel-booking-engine-pms-cross-site-request-forgery","VikBooking Hotel Booking Engine & PMS \u003C= 1.8.12 - Cross-Site Request Forgery","The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","vikbooking",null,"\u003C=1.8.12","1.8.13","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-07-01 00:00:00","2026-07-07 19:58:03",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F337bb11f-dcab-4914-aeb4-68084504b8f9?source=api-prod",7,[22,23,24,25,26,27,28],"admin\u002Fcontroller.php","admin\u002Fhelpers\u002Feinvoicing\u002Fdrivers\u002Fmydata_aade.php","admin\u002Fhelpers\u002Freport\u002Frms_occupancy_pace.php","admin\u002Fhelpers\u002Fsrc\u002Fbooking\u002Fregistry.php","admin\u002Fhelpers\u002Fsrc\u002Ftaxonomy\u002Ffinance.php","admin\u002Fhelpers\u002Fwidgets\u002Fdoor_access_control.php","admin\u002Fhelpers\u002Fwidgets\u002Fnotifications_center.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-57723 (VikBooking CSRF)\n\n## 1. Vulnerability Summary\nThe **VikBooking Hotel Booking Engine & PMS** plugin for WordPress (versions \u003C= 1.8.12) contains a Cross-Site Request Forgery (CSRF) vulnerability. The administrative controller `VikBookingController` in `admin\u002Fcontroller.php` fails to implement nonce validation (e.g., `check_admin_referer`) on several state-changing tasks. Specifically, the `add_fest` method allows for the unauthorized creation of \"festivities\" (special dates\u002Fholidays that affect pricing or availability) in the booking engine.\n\n## 2. Attack Vector Analysis\n- **Target Endpoint**: `\u002Fwp-admin\u002Fadmin.php`\n- **Hook\u002FAction**: The plugin uses a Joomla-style controller pattern. Tasks are dispatched via the `page` and `task` parameters.\n- **Vulnerable Task**: `add_fest`\n- **Parameters**:\n    - `page`: The administrative page slug (typically `vikbooking_dashboard` or `vikbooking` (inferred)).\n    - `task`: `add_fest`\n    - `dt`: The date of the festivity (format: `Y-m-d`).\n    - `name`: The name of the festivity.\n    - `type`: The type of festivity (defaults to `custom`).\n    - `descr`: A description for the festivity.\n- **Authentication**: Requires a logged-in Administrator to be the victim of the forged request.\n- **Preconditions**: The attacker must know or guess the admin page slug for VikBooking.\n\n## 3. Code Flow\n1. **Entry Point**: A request is made to `wp-admin\u002Fadmin.php?page=[SLUG]&task=add_fest`.\n2. **Dispatcher**: WordPress loads the plugin's admin page handler, which instantiates `VikBookingController` (found in `admin\u002Fcontroller.php`).\n3. **Task Execution**: The `add_fest()` method is invoked.\n4. **Input Processing**:\n   - `VikRequest::getString('dt', ...)` retrieves the date.\n   - `VikRequest::getString('name', ...)` retrieves the name.\n   - The code validates that `name` and `dt` are not empty (lines 144-146).\n5. **Sink**:\n   - `VikBooking::getFestivitiesInstance()->storeFestivity($dt, $new_fest, $type, $descr)` is called (line 154).\n   - This writes the new festivity data directly to the database without any `check_admin_referer()` or nonce check.\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability is characterized by **missing** nonce validation. Therefore, no nonce is required to successfully exploit the `add_fest` task.\n\nIf a nonce were required but \"incorrectly\" implemented, the agent would:\n1. Navigate to the VikBooking dashboard: `wp-admin\u002Fadmin.php?page=vikbooking_dashboard`.\n2. Use `browser_eval` to search for localized script data (e.g., `window.vbo_data?.nonce`).\n3. However, based on `admin\u002Fcontroller.php`, the method `add_fest` performs no check at all, making it a \"Zero-Nonce\" exploit.\n\n## 5. Exploitation Strategy\nThe goal is to demonstrate that an unauthenticated attacker can force an administrator to add a festivity that could disrupt hotel availability or pricing.\n\n### Step 1: Discover Admin Slug\nThe agent should first identify the correct menu slug for the plugin.\n```bash\n# Use WP-CLI to find the slug\nwp menu list --allow-root\n# Or search for add_menu_page in the source (outside of provided snippets)\n```\n*Assumption*: The slug is `vikbooking_dashboard`.\n\n### Step 2: Forge the Request\nUsing the `http_request` tool, simulate the CSRF attack. Since `VikRequest::getString` uses the `'request'` source, it accepts both GET and POST.\n\n**Request Payload (GET):**\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=vikbooking_dashboard&task=add_fest&dt=2025-12-25&name=CSRF_HOLIDAY&type=custom&descr=Created_via_CSRF`\n- **Method**: `GET`\n- **Headers**: Use cookies of a logged-in administrator.\n\n**Request Payload (POST - More realistic for CSRF):**\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=vikbooking_dashboard`\n- **Method**: `POST`\n- **Body (URL-Encoded)**: `task=add_fest&dt=2025-12-25&name=CSRF_HOLIDAY&type=custom&descr=Created_via_CSRF`\n- **Headers**: `Content-Type: application\u002Fx-www-form-urlencoded`\n\n## 6. Test Data Setup\n1. **Plugin Installation**: Ensure `vikbooking` version 1.8.12 is installed and active.\n2. **Administrator Session**: Ensure the execution agent has the session cookies for a user with `administrator` privileges.\n3. **No existing fests**: Clear existing festivities for the target date to ensure a clean verification.\n\n## 7. Expected Results\n- The server should return a `200 OK` response.\n- The response body will likely contain JSON starting with `{\"html\":...` as seen in the latter part of the controller (lines 161+), though truncated in the snippet.\n- The festivity \"CSRF_HOLIDAY\" should be present in the plugin's internal registry.\n\n## 8. Verification Steps\nAfter sending the `http_request`, verify the impact via WP-CLI or database check:\n\n```bash\n# Check the database for the new entry\nwp db query \"SELECT * FROM wp_vikbooking_fests WHERE name LIKE '%CSRF_HOLIDAY%';\" --allow-root\n\n# Alternatively, check if the festivity appears in the plugin's options\u002Fmeta if stored there\nwp option get vikbooking_fests --allow-root\n```\n\n## 9. Alternative Approaches\nIf `add_fest` is protected by a global check not visible in the snippet, attempt to exploit `donut_charts_data` (line 62). While primarily a `GET` request for data, if it were to log access or update \"last viewed\" stats, it could be used for CSRF, though `add_fest` is a much stronger proof of \"Unauthorized Action\" (Integrity impact).\n\nAnother target is the **e-invoicing driver settings** seen in `admin\u002Fhelpers\u002Feinvoicing\u002Fdrivers\u002Fmydata_aade.php`. If the `vboSetFilters` JS function triggers an AJAX call back to `admin-ajax.php` without a nonce, settings like `excludebid` could be manipulated.","gemini-3-flash-preview","2026-07-25 12:18:39","2026-07-25 12:19:32",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","1.8.12","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.13","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.13.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags"]