CVE-2026-9830 README

The project's README from github.com/opaxial/CVE-2026-9830. As one markdown file: README.md.

CVE-2026-9830 BookingPress Pro API Assessment PoC

This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data.

Authorization Required

Use this project only against systems you own or are explicitly authorized to assess. Do not run it against public, third-party, or production systems without written permission. Handle any retrieved booking data as sensitive personal information.

Scope

The script:

Requirements

Install the Python dependency in an isolated environment:

python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install requests

Usage

Review the available options locally:

python3 main.py --help

For an authorized validation, provide the target through the command-line interface. Start with the non-invasive check mode and avoid collecting or retaining data beyond the approved assessment scope.

Output and Data Handling

The tool can write API responses to JSON files. Those files may contain customer names, email addresses, telephone numbers, booking dates, and service details.

Remediation Guidance

Site owners and BookingPress administrators should:

  1. Upgrade BookingPress Pro and WordPress to supported versions with all vendor security fixes applied.
  2. Confirm that booking-related REST routes enforce authentication and capability checks before returning customer data.
  3. Restrict administrative and API access using least privilege and, where appropriate, network controls.
  4. Review web and application logs for unusual requests to BookingPress REST endpoints.
  5. Rotate credentials and follow the organization’s incident-response process if exposure is suspected.

Verification

After remediation, repeat the authorized check and confirm that unauthenticated requests cannot return booking or customer records. Record only the minimum evidence needed to demonstrate the fix.

Disclaimer

This code is provided for defensive security testing, verification, and research. The repository maintainer and contributors are not responsible for unauthorized use.

CVE-2026-9830 (opaxial/CVE-2026-9830)

Searching Database…

477 ·GitHub
CVE-2026-9830
这是什么？一个 Python 概念验证脚本，用于验证 WordPress 插件 BookingPress Pro 被报告的未授权 REST API 暴露问题，该问题可能泄露预订和客户数据。
这是我运行的脚本，还是我导入的库？它是一个独立的命令行 Python 脚本，而不是库 — 你可以在终端中直接针对目标 WordPress 网站运行它。
怎么对目标运行检测？在隔离的 Python 环境中安装 'requests' 包，然后通过命令行调用脚本并传入目标 WordPress URL，先从非侵入式的检测模式开始。
运行它需要安装什么？Python 3.8 或更高版本，外加 'requests' 包。
它对任何 WordPress 网站都有效吗？不能，它只针对运行着存在漏洞的 BookingPress Pro REST 端点的站点，并且只能用于你拥有或获得明确授权评估的系统。
它获取到的数据会怎样处理？一次成功的请求可能返回真实的预订和客户记录（姓名、电子邮箱、电话号码、预订详情）；任何保存下来的输出都应存放在加密且限制访问的存储中，并按委托约定的保留期限删除。
为什么要发布这个 PoC？是为了帮助站长和安全团队验证并修复 BookingPress Pro 中未授权的数据暴露问题，而不是恶意利用它。
如果站点已受影响，站长该怎么办？把 BookingPress Pro 和 WordPress 升级到已修复的版本，对预订相关的 REST 路由强制要求身份验证，轮换凭据，并检查请求日志中是否有此前被滥用的迹象。
它能把 API 响应保存下来用于报告吗？可以，获得授权的评估人员可以让工具把返回的 JSON 响应写入本地文件，作为发现的证据。
我可以配置哪些请求选项？在探测端点时，脚本支持设置超时、代理、自定义 User-Agent、指定预订 ID 以及日期过滤。
What are similar projects?xray, CVE-2026-62911, VulnHunter, XSStrike, dirtyfrag, exploitarium, Claude-BugHunter, Claude-Red
Which topics is it in?poc, cve, ethical-hacking, wordpress, web-security, vulnerability-scanner, vulnerability, exploit, hacking-tool, red-team, pentesting, penetration-testing
Creator
opaxial
Size
<0.1 MB
Stars
477
Updated
CommitAug 20
Age
2mo
Commits · 90 Days