CVE-2026-103305 in Prenotazioni Plugin
Summary
by MITRE • 10/11/2026
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in the Prenotazioni WordPress plugin versions up to 1.7.5 represents a critical security failure rooted in insufficient access control mechanisms and inadequate input sanitization practices. This flaw allows unauthenticated attackers to manipulate administrative settings without valid authentication tokens or cross-site request forgery protections, fundamentally undermining the integrity of the application's configuration state. The absence of authorization checks means that any user with network access to the WordPress installation can interact with sensitive endpoints designed exclusively for administrators, while the lack of CSRF protection ensures these actions cannot be trivially triggered via malicious web pages visited by an authenticated administrator.
From a technical perspective, the core issue lies in how the plugin handles data persistence and rendering. When saving settings, the application fails to verify that the request originates from a legitimate administrative session or contains valid nonces required for state-changing operations. This oversight permits arbitrary modification of configuration parameters. Furthermore, when these modified values are subsequently rendered on web pages served to users, they are not properly escaped against HTML entities. Consequently, if an attacker injects malicious script payloads into these settings fields during the unsanitized save operation, those scripts will execute in the context of any user viewing the affected page or administrative dashboard where the setting is displayed.
This combination of flaws facilitates Stored Cross-Site Scripting attacks with significant operational impact. Unlike reflected XSS which requires complex social engineering to trick a specific victim into clicking a crafted link, stored vulnerabilities persist on the server side and affect all visitors who load the compromised content. For site administrators, this can lead to complete account takeover through session hijacking or credential theft if malicious scripts exfiltrate authentication cookies or tokens. For general site visitors, it may result in defacement, redirection to phishing sites, or malware distribution via drive-by downloads initiated by the injected script code executing within their browser environment.
In terms of industry classification standards, this vulnerability aligns with CWE-284 Improper Access Control and CWE-352 Cross-Site Scripting (XSS). The failure to implement CSRF protections also relates closely to CWE-352 as well, highlighting a systemic deficiency in securing state-changing operations. Within the MITRE ATT&CK framework, this behavior maps to techniques such as T1078 Valid Accounts for initial access if an attacker can escalate privileges after gaining admin control via XSS, and T1189 Drive-by Compromise or T1566 Phishing depending on how the stored payload is delivered. The persistence of the malicious code in the database ensures long-term impact until remediation occurs.
Mitigation strategies must address both the access control gaps and the input handling deficiencies immediately. Administrators should update the Prenotazioni plugin to version 1.7.6 or later where these issues have been resolved by implementing proper nonce verification for all administrative actions and enforcing strict capability checks before processing settings updates. Additionally, developers must ensure that all dynamic content outputted from database-stored values is passed through appropriate escaping functions such as esc_html or wp_kses_post to neutralize potential script execution contexts. Until an update is available, temporary workarounds include restricting access to the WordPress admin area via IP whitelisting in web server configurations and disabling public-facing features of the plugin if they are not essential for business operations. Regular security audits focusing on input validation and output encoding practices across all custom plugins can prevent similar vulnerabilities from arising in future development cycles.