Attack Chain

1. Attacker navigates to the public page containing the [babe-booking-form] shortcode.
2. Attacker initiates a guest booking flow, which generates a valid order_id, order_num, and order_hash.
3. Attacker submits the booking form while injecting a malicious payload into the first_name parameter.
4. The application processes the request, invoking the action_to_pay() handler.
5. The server stores the malicious JavaScript payload in the database without proper sanitization.
6. An administrative or other user visits the page where the stored booking information is rendered.
7. The user's browser executes the injected JavaScript payload, potentially leading to unauthorized actions or data exfiltration.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of users viewing the booking information. This can result in session hijacking, administrative account compromise, and unauthorized access to sensitive booking data, impacting any WordPress site utilizing the affected version of the BA Book Everything plugin.

Recommendation

• Update the BA Book Everything plugin to a version released after 1.8.27 to mitigate CVE-2026-96039.
• Audit access logs for high-frequency booking form submissions that include non-standard characters (like <script> or alert()) in the first_name field.
• Monitor webserver access logs for POST requests to the plugin's booking handler followed by subsequent requests to the order payment or detail pages.