CVE-2026-9830 README

The project's README from github.com/opaxial/CVE-2026-9830. As one markdown file: README.md.

CVE-2026-9830 BookingPress Pro API Assessment PoC

This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data.

Authorization Required

Use this project only against systems you own or are explicitly authorized to assess. Do not run it against public, third-party, or production systems without written permission. Handle any retrieved booking data as sensitive personal information.

Scope

The script:

Requirements

Install the Python dependency in an isolated environment:

python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install requests

Usage

Review the available options locally:

python3 main.py --help

For an authorized validation, provide the target through the command-line interface. Start with the non-invasive check mode and avoid collecting or retaining data beyond the approved assessment scope.

Output and Data Handling

The tool can write API responses to JSON files. Those files may contain customer names, email addresses, telephone numbers, booking dates, and service details.

Remediation Guidance

Site owners and BookingPress administrators should:

  1. Upgrade BookingPress Pro and WordPress to supported versions with all vendor security fixes applied.
  2. Confirm that booking-related REST routes enforce authentication and capability checks before returning customer data.
  3. Restrict administrative and API access using least privilege and, where appropriate, network controls.
  4. Review web and application logs for unusual requests to BookingPress REST endpoints.
  5. Rotate credentials and follow the organization’s incident-response process if exposure is suspected.

Verification

After remediation, repeat the authorized check and confirm that unauthenticated requests cannot return booking or customer records. Record only the minimum evidence needed to demonstrate the fix.

Disclaimer

This code is provided for defensive security testing, verification, and research. The repository maintainer and contributors are not responsible for unauthorized use.

CVE-2026-9830 (opaxial/CVE-2026-9830)

ethical-hacking
Searching Database…

477 ·GitHub
CVE-2026-9830
What is this?A Python proof-of-concept that validates a reported unauthenticated REST API exposure in the BookingPress Pro WordPress plugin, which can leak booking and customer data.
Is this a script I run, or a library I import?It is a standalone command-line Python script, not a library — you run it directly from a terminal against a target WordPress site.
How do I run a check against a target?Install the 'requests' package in an isolated Python environment, then invoke the script via its CLI with the target WordPress URL, starting with the non-invasive check mode.
What do I need installed to run it?Python 3.8 or later plus the 'requests' package.
Does it work against any WordPress site?No, it only targets installs running the vulnerable BookingPress Pro REST endpoint, and it must only be used against systems you own or are explicitly authorized to assess.
What happens to the data it retrieves?A successful request can return real booking and customer records (names, emails, phone numbers, booking details); any saved output should be kept in encrypted, access-limited storage and deleted per the engagement's retention policy.
Why was this PoC published?To help site owners and security teams verify and remediate an unauthenticated data exposure in BookingPress Pro rather than exploit it maliciously.
What should a site owner do if exposed?Upgrade BookingPress Pro and WordPress to patched versions, enforce authentication on booking REST routes, rotate credentials, and review request logs for signs of prior abuse.
Can it save the API responses for a report?Yes, an authorized assessor can have the tool write the returned JSON response to a local file as evidence for a finding.
What request options can I configure?The script supports setting a timeout, proxy, custom user-agent, specific booking ID, and date filters when probing the endpoint.
What are similar projects?xray, CVE-2026-62911, VulnHunter, XSStrike, dirtyfrag, exploitarium, Claude-BugHunter, Claude-Red
Which topics is it in?poc, cve, ethical-hacking, wordpress, web-security, vulnerability-scanner, vulnerability, exploit, hacking-tool, red-team, pentesting, penetration-testing
Creator
opaxial
Size
<0.1 MB
Stars
477
Updated
CommitAug 20
Age
2mo
Commits · 90 Days