Booking System Trafft EUVD-2026-50273

Three specific conditions must be simultaneously true for exploitation to succeed. First, the Booking System Trafft plugin must be operating in agency mode - this is the operational configuration that causes the vulnerable nonce to be printed on admin pages accessible to lower-privilege roles; sites not in agency mode are not exploitable regardless of plugin version. Second, the attacker must hold a valid authenticated account at Subscriber level or above - unauthenticated exploitation is blocked because the AJAX handler requires a valid nonce, which is only issued to logged-in sessions; the attacker does not need to perform any privileged administrative action, only submit one AJAX request with the stored nonce. Third, the booking shortcode must be embedded on at least one public-facing page for stored payload delivery to affect visitors. Exploitation is constrained by: the non-default agency mode requirement; the need for an existing authenticated account (requiring open registration or pre-existing access); and the fact that impact is contingent on visitors loading pages with the shortcode. Sites with closed registration and no agency mode requirement face negligible real-world risk.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N scores 6.4, which modestly understates operational risk for affected deployments. The S:C (Scope Changed) metric is the most impactful dimension: a single write by a Subscriber-level attacker poisons the embed-script URL globally, turning every front-end booking page into an XSS delivery vehicle for all visitors including administrators, enabling session hijacking and privilege escalation. The UI:N metric on the attacker side is correct - once the malicious URL is stored, no further attacker interaction is needed; the payload executes passively for every subsequent visitor. No EPSS score was provided in the input data; no CISA KEV listing is present, indicating no confirmed widespread exploitation at time of analysis. No public POC has been identified. The primary real-world risk limiter is the agency mode requirement - sites not operating in agency mode are not vulnerable regardless of version, and sites without open user registration significantly reduce the attacker's ability to obtain a Subscriber account. For sites that do run in agency mode with open registration, this is a genuine high-priority remediation target despite the medium CVSS score.

An attacker registers a free Subscriber-level account on a WordPress site running Booking System Trafft in agency mode, then navigates to profile.php to harvest the nonce printed inline on the page. The attacker submits a POST request to wp-admin/admin-ajax.php with action=set_options and a bookingWebsiteUrl pointing to an attacker-controlled domain hosting a malicious embed.js file. From that moment forward, every site visitor - including administrators - who loads any page containing the booking shortcode automatically fetches and executes the attacker's JavaScript, enabling session cookie theft, keylogging, or administrative account takeover.