CVE-2026-8791 in Booking System Trafft Plugin
Summary
by MITRE • 07/29/2026
The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option('trafft_option', ['bookingWebsiteUrl' => ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `<bookingWebsiteUrl>/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability identified in the Booking System Trafft plugin for WordPress represents a critical stored cross-site scripting flaw that exploits insufficient access controls within the plugin's administrative interface. This weakness exists specifically in versions up to and including 1.0.17 and is particularly dangerous when the plugin operates in agency mode. The core issue stems from a missing capability check within the `set_options` AJAX action, which allows any authenticated user with subscriber-level privileges or higher to manipulate critical plugin settings through the administrative interface.
The technical flaw manifests through the `trafftSetOptions()` handler function that processes AJAX requests to update plugin options. While this handler does validate a nonce for request authenticity, it completely bypasses any verification of user capabilities or permissions before executing the `update_option()` function. This oversight creates an attack vector where malicious users can modify the `bookingWebsiteUrl` setting without proper authorization. The nonce validation mechanism, though present, is rendered ineffective because the nonce value is exposed inline on every admin page including profile.php, making it accessible to all authenticated users regardless of their role permissions.
The operational impact of this vulnerability extends far beyond simple data manipulation, creating a persistent threat that can compromise every visitor to the affected website. When the `bookingWebsiteUrl` setting is modified by an attacker, the subsequent `trafftAdminAssets()` function uses this value to enqueue JavaScript assets from the attacker-controlled domain. This script loading occurs on every front-end page that displays the booking shortcode, effectively turning every visitor's browser into a potential execution environment for malicious code. The implications are severe because administrators who visit pages containing the booking shortcode become victims of their own privilege escalation, as the embedded JavaScript executes with the privileges of the admin user's session.
The vulnerability aligns with CWE-79 (Cross-Site Scripting) and specifically demonstrates characteristics consistent with CWE-352 (Cross-Site Request Forgery) through the improper access control mechanism. From an ATT&CK perspective, this represents a privilege escalation technique followed by a persistence mechanism that leverages the web application's legitimate script loading functionality. The attack chain begins with a low-privilege user gaining access to administrative settings through insufficient capability checks, then exploits the plugin's legitimate functionality to deliver malicious JavaScript payloads to all website visitors. This vulnerability directly violates principle of least privilege and demonstrates how improper access controls can create persistent security weaknesses that affect entire user bases.
Mitigation strategies should focus on implementing proper capability checks within the plugin's AJAX handling functions, ensuring that only users with appropriate administrative privileges can modify critical settings. The nonce validation should be complemented by role-based access control verification before any option updates occur. Additionally, administrators should immediately update to patched versions of the plugin or implement temporary workarounds such as restricting user roles and capabilities, disabling the agency mode functionality, or implementing network-level protections that block requests to potentially malicious domains. Regular monitoring of plugin settings and user activity logs should also be implemented to detect unauthorized modifications that may indicate exploitation attempts.