Unauthorized Booking Cancellation in WPS Bookings for WooCommerce

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the WPS Bookings for WooCommerce WordPress plugin before version 3.11.7. It allows any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

Check if the WPS Bookings for WooCommerce plugin version is below 3.11.7. Look for unauthorized booking cancellations in system logs. Inspect network traffic for requests to the plugin's cancellation endpoint with manipulated order IDs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cancel your booking orders without your consent, potentially causing financial loss or disrupting services. The attacker only needs a valid nonce, which is easily obtainable from any front-end page.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized modifications to user data, potentially violating data integrity and access control requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WPS Bookings for WooCommerce plugin to version 3.11.7 or later immediately. Review and revoke any unauthorized booking cancellations. Monitor user activity for suspicious actions related to booking orders.

Useful 0 Not Useful 0