## https://sploitus.com/exploit?id=C946FC2B-AB27-5636-AB9C-0AE6E9C6A4FE
# CVE-2026-9830 BookingPress Pro API Assessment PoC
This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data.
## Authorization Required
Use this project only against systems you own or are explicitly authorized to assess. Do not run it against public, third-party, or production systems without written permission. Handle any retrieved booking data as sensitive personal information.
## Scope
The script:
- Normalizes a supplied WordPress target URL.
- Checks the BookingPress Pro REST API endpoint for an exposed booking response.
- Can save a returned response locally when invoked by an authorized assessor.
- Supports timeout, proxy, user-agent, booking ID, and date filtering configuration.
## Requirements
- Python 3.8 or later
- The `requests` package
Install the Python dependency in an isolated environment:
```bash
python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install requests
```
## Usage
Review the available options locally:
```bash
python3 main.py --help
```
For an authorized validation, provide the target through the command-line interface. Start with the non-invasive check mode and avoid collecting or retaining data beyond the approved assessment scope.
## Output and Data Handling
The tool can write API responses to JSON files. Those files may contain customer names, email addresses, telephone numbers, booking dates, and service details.
- Store outputs only in approved encrypted locations.
- Limit access to authorized assessment staff.
- Redact personal data from tickets, reports, and demonstrations.
- Delete assessment artifacts according to the engagement's retention policy.
## Remediation Guidance
Site owners and BookingPress administrators should:
1. Upgrade BookingPress Pro and WordPress to supported versions with all vendor security fixes applied.
2. Confirm that booking-related REST routes enforce authentication and capability checks before returning customer data.
3. Restrict administrative and API access using least privilege and, where appropriate, network controls.
4. Review web and application logs for unusual requests to BookingPress REST endpoints.
5. Rotate credentials and follow the organization’s incident-response process if exposure is suspected.
## Verification
After remediation, repeat the authorized check and confirm that unauthenticated requests cannot return booking or customer records. Record only the minimum evidence needed to demonstrate the fix.
## Disclaimer
This code is provided for defensive security testing, verification, and research. The repository maintainer and contributors are not responsible for unauthorized use.