Attack Chain

1. Attacker identifies the target WordPress site using the BA Book Everything plugin.
2. Attacker crafts a malicious JavaScript payload intended for execution in an admin's browser.
3. Attacker initiates a booking request and sends a crafted POST request containing the script in the 'booking_service_qty' parameter.
4. The plugin fails to sanitize the input and stores the malicious script in the WordPress database associated with the order.
5. An administrator logs into the WordPress wp-admin dashboard to manage or review incoming orders.
6. The administrator accesses the compromised order record via the plugin's order management interface.
7. The browser renders the stored order details, triggering the execution of the attacker's script in the context of the administrator's authenticated session.
8. The attacker achieves their objective, such as creating a new admin user, exfiltrating session tokens, or modifying site configuration.

Impact

Successful exploitation results in the execution of arbitrary code within the administrator's browser session. Given that the payload is viewed in the wp-admin management area, the attacker can hijack active sessions, perform administrative tasks, or inject further malicious content into the WordPress site, potentially affecting site integrity and the security of all registered users.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

• Update the BA Book Everything plugin to version 1.8.29 or the latest available patched version immediately.
• Audit existing order records within the plugin for suspicious scripts, specifically looking for common HTML/JavaScript tags (e.g., <script>, onerror, onload) in numeric fields.
• Monitor webserver logs for POST requests to the booking endpoint containing non-numeric characters within the 'booking_service_qty' parameter.