CVE-2016-20070

Vulnerability

The WordPress Booking Calendar Contact Form plugin version 1.0.23 (and possibly earlier) contains privilege escalation and stored cross-site scripting vulnerabilities. The plugin fails to verify user capabilities before allowing modifications to plugin options, and it does not sanitize input parameters such as price, name, calendar_language, and email_confirmation_to_user. These parameters are processed via the admin-ajax.php and admin.php endpoints, making the code path reachable by any authenticated user, including subscribers [1][3].

Exploitation

An attacker with a subscriber-level account can exploit the missing privilege checks by sending crafted POST requests to the WordPress admin endpoints. The attacker injects malicious JavaScript payloads into unsuspecting parameters like price or name. No special network position is required beyond normal authenticated access; user interaction is not required for the initial injection, but the stored script executes when an administrator views the affected pages [3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of an administrator. This can lead to privilege escalation, as the attacker can perform actions like creating new admin users, modifying site content, or stealing session cookies. The confidentiality, integrity, and availability of the WordPress site are compromised, with the attacker gaining the ability to fully control the site from an administrator's session [3].

Mitigation

As of the available references, a fixed version has not been disclosed. Users of version 1.0.23 should consider upgrading to any later version provided by the vendor (http://wordpress.dwbooster.com/) [2][3]. No workaround is mentioned; until a patch is applied, the plugin remains vulnerable to these attacks.