Unauthenticated Customer Data Export in Course Booking System WordPress Plugin

Executive Summary

The Course Booking System WordPress plugin before version 7.0.9 has a flaw where unauthenticated users can access and download personally identifiable information (PII) of all customers who booked courses. This includes names, email addresses, and billing addresses. The issue occurs because the plugin does not restrict access to its booking export functionality.

Useful 0 Not Useful 0

Detection Guidance

Check if unauthenticated users can access the booking export endpoint. Use curl to test the export URL, e.g., curl -v http://your-wordpress-site.com/wp-admin/admin-post.php?action=export_bookings. If it returns customer data without authentication, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to steal sensitive customer data without authentication. If you use this plugin, your customers' personal and billing information could be exposed, leading to privacy breaches, identity theft, or misuse of data. The impact includes reputational damage and potential legal consequences.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access and disclosure of personal data. GDPR requires protecting personal data and reporting breaches, while HIPAA mandates safeguarding protected health information. Non-compliance could result in fines or penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Course Booking System plugin to version 7.0.9 or later immediately. If an update is not available, disable the plugin temporarily until a patch is released. Review server logs for unauthorized access attempts to the export endpoint.

Useful 0 Not Useful 0