WPBookit CVE-2025-26910

Exploitation requires an authenticated WordPress administrator with active WPBookit plugin management permissions to interact with attacker-controlled content (click malicious link, visit compromised page, open crafted email HTML) while holding a valid WordPress session cookie. The vulnerability specifically targets administrative functions within the WPBookit plugin interface where booking data or configuration settings are processed without proper CSRF token validation and input sanitization. Default WordPress installations with WPBookit activated through version 1.0.1 are vulnerable regardless of specific configuration settings. Exploitation is limited by the requirement for social engineering to achieve the mandatory user interaction (UI:R) and the need to target authenticated users with elevated WordPress privileges, though once achieved, the stored XSS component affects all users viewing the poisoned booking data without further interaction requirements.

Real-world risk is moderate despite the 7.1 CVSS score, requiring careful context. The attack requires user interaction (UI:R) - an authenticated WordPress administrator must click a malicious link or visit an attacker-controlled page while logged in. EPSS exploitation probability of 0.05% (14th percentile) suggests this is not being actively targeted at scale, and no public exploit code or CISA KEV listing exists at time of analysis. However, CSRF+XSS chains are well-understood attack patterns with readily available tools, making this automatable once initial social engineering succeeds. The technical impact is significant: stored XSS persists across sessions and can affect multiple administrative users, enabling session theft, privilege escalation within WordPress, or deployment of web shells. Primary risk factors are: (1) targets WordPress administrators specifically, (2) requires active WPBookit plugin installation (limited install base compared to major plugins), (3) exploitation complexity is low once victim interaction occurs. Organizations using WPBookit should prioritize patching, especially if the plugin is exposed to environments where administrators might click external links or visit untrusted sites while logged in.

An attacker identifies a WordPress site running WPBookit 1.0.1 and crafts a malicious webpage containing hidden CSRF forms that submit booking data with embedded JavaScript payloads to the plugin's vulnerable administrative endpoints. The attacker sends the page URL to the site administrator via phishing email or social media, framed as a legitimate business inquiry or plugin review. When the administrator clicks the link while authenticated to WordPress, their browser automatically submits the forged request, bypassing CSRF protections and injecting persistent XSS into the booking system database. Subsequently, when the administrator or other privileged users view the booking management interface, the stored JavaScript executes, exfiltrating session cookies to an attacker-controlled server, enabling full administrative account takeover and potential site defacement or malware distribution to site visitors.