Executive Summary

This vulnerability exists in the Booking Calendar | Appointment Booking | Bookit WordPress plugin up to version 2.5.0. It is caused by a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API endpoint, which allows unauthenticated attackers to connect their own Stripe accounts to the site and receive payments. Essentially, the REST endpoint did not properly restrict access, enabling unauthorized users to modify data related to Stripe account connections. [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthenticated attackers to connect their own Stripe accounts to your WordPress site via the vulnerable REST API endpoint. This means attackers could potentially receive payments intended for your site, leading to financial loss and unauthorized control over payment processing. Since the vulnerability allows unauthorized modification of data related to Stripe connections, it compromises the integrity of your payment system. [2]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your WordPress site is running the Bookit plugin version 2.5.0 or earlier. Specifically, monitoring requests to the REST API endpoint '/wp-json/bookit/v1/commerce/stripe/return' for unauthorized access attempts could indicate exploitation. Using tools like curl or wget, you can test the endpoint's permission enforcement. For example, running a command like `curl -I https://your-site.com/wp-json/bookit/v1/commerce/stripe/return` and checking if it allows unauthenticated access (HTTP 200) may indicate vulnerability. Additionally, reviewing your web server logs for unexpected POST or GET requests to this endpoint from unauthenticated sources can help detect exploitation attempts. [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Bookit plugin to version 2.5.1 or later, where the vulnerability is fixed by enforcing proper permission checks on the vulnerable REST API endpoint. This update changes the permission callback to restrict access to users with the 'manage_options' capability, typically administrators, preventing unauthorized Stripe account connections. If updating immediately is not possible, consider restricting access to the '/wp-json/bookit/v1/commerce/stripe/return' endpoint via web server rules or firewall to trusted users only. [2]

Useful 0 Not Useful 0