CVE-2024-13323
📋 TL;DR
The WP Booking Calendar plugin for WordPress has a stored XSS vulnerability that allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. These scripts execute whenever users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- WP Booking Calendar WordPress Plugin
📦 What is this software?
Wp Booking Calendar by Wpbookingcalendar
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor access inject malicious scripts to steal user session cookies or credentials, potentially escalating privileges.
If Mitigated
With proper user access controls and content security policies, impact is limited to script execution in the context of the vulnerable page.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has contributor privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.9.3 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3220625/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WP Booking Calendar
4. Click 'Update Now' if available
5. If no update appears, download version 10.9.3+ from WordPress.org
6. Deactivate, delete old version, upload and activate new version
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the WP Booking Calendar plugin until patched
wp plugin deactivate booking
Restrict User Roles
allRemove contributor-level access from untrusted users
wp user list --role=contributor --field=ID
wp user set-role <user_id> subscriber
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Regularly audit user accounts and remove unnecessary contributor-level access
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 10.9.2 or lower, you are vulnerable.Check Version:
wp plugin get booking --field=versionVerify Fix Applied:
After updating, verify plugin version shows 10.9.3 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to booking-related endpoints
- Multiple failed login attempts followed by successful contributor login
- Suspicious script tags in page content containing booking shortcodes
Network Indicators:
- Unexpected outbound connections from WordPress site after visiting booking pages
- Suspicious JavaScript loading from booking calendar pages
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/post.php" OR uri_path="/wp-admin/admin-ajax.php") AND (user_agent CONTAINS "script" OR params CONTAINS "booking_calendar")