Description

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:05.523Z",
  "pubdate": "2026-09-23T06:17:05.523Z",
  "executiveSummary": "The Booking Manager WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient authorization checks when handling user-specific settings updates.\nThis vulnerability exists in all versions prior to 2.1.21, allowing any authenticated user—including those with low-privilege subscriber accounts—to modify the settings of any other user within the system.\nThe primary risk implication is the potential for privilege escalation or unauthorized configuration changes, as an attacker can manipulate settings belonging to administrative accounts.\nThe flaw stems from a lack of server-side validation ensuring that the user submitting a request has the appropriate ownership or administrative authorization to modify the targeted user record.\nExploitation requires the attacker to be authenticated as a registered user of the WordPress instance. No advanced technical skills or specialized software are required to manipulate the HTTP requests to facilitate this unauthorized access.\nThe potential for full site impact exists if the configurable settings allow for redirecting traffic, modifying administrative profile metadata, or triggering unintended plugin behavior that affects system-wide security.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a proper access control mechanism or nonce validation during the processing of user setting updates within the Booking Manager plugin. Specifically, the component responsible for handling the submission of per-user configuration data fails to perform a verification check comparing the identity of the requesting user against the identity of the user object being modified.\nIn a secure implementation, the application should verify the current user's session token and ensure the user ID provided in the payload matches the session user, or alternatively, confirm that the requester possesses administrative privileges. Because this verification is bypassed, the application implicitly trusts the user-supplied identifier in the request parameter, allowing it to apply changes to any account record.\nThe exploitation flow begins when an authenticated attacker intercepts a valid configuration update request sent by the plugin. The attacker then modifies the request parameters to replace their own user ID or target reference with the user ID of a victim, such as a site administrator. Upon sending the forged request, the plugin backend proceeds to update the database entries for the victim account as if the request were authorized.\nThis behavior falls under the category of IDOR, as the plugin relies on predictable or exposed references to locate and modify records without subsequent validation. Since the plugin is integrated into the WordPress ecosystem, it operates within the context of the current session, granting the attacker a persistent method to manipulate target data.\nThe attack is effective because the plugin architecture treats the user-supplied reference as the primary key for update operations without checking the 'current_user' context. Consequently, an attacker can influence the behavior of the Booking Manager for any user, including high-privilege administrators. The post-exploitation impact includes the ability to alter plugin-specific site settings that could be leveraged to disrupt services, perform phishing or social engineering via the manipulated settings, or potentially escalate privileges if the configuration allows for further administrative interactions.\nThe vulnerability affects all versions of the Booking Manager WordPress plugin prior to 2.1.21. The attack vector is restricted to registered users, effectively limiting the scope to internal threats or compromised accounts, but the impact remains significant due to the lack of privilege differentiation in the vulnerable code path."
}