Attack Chain

1. An attacker identifies the target WordPress site running a vulnerable version of JetAppointment.
2. The attacker crafts a malicious HTTP POST request targeting the 'jet_engine_form_booking_submit' endpoint.
3. The attacker includes a JavaScript payload within the 'friendlyTime' parameter of the request body.
4. The plugin fails to sanitize the input and saves the payload directly into the 'wp_jet_appointments_meta' table in the WordPress database.
5. An administrator logs into the WordPress dashboard and navigates to the appointment management section.
6. The plugin retrieves the malicious record and renders it in the appointment details popup.
7. The administrator's browser executes the stored JavaScript, enabling further malicious activity such as account creation or privilege escalation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a WordPress administrator's session. This could result in the unauthorized creation of administrative accounts, modification of site content, or the exfiltration of sensitive site configuration data. The vulnerability affects all users running JetAppointment version 2.5.2.1 or earlier.

Recommendation

Prioritized, concrete actions for detection engineering and security operations teams:

• Update the JetAppointment plugin to a patched version beyond 2.5.2.1 as soon as an update becomes available.
• Implement a Web Application Firewall (WAF) rule to block POST requests to 'jet_engine_form_booking_submit' that contain script tags or suspicious JavaScript patterns in the 'friendlyTime' parameter.
• Monitor web server access logs for anomalous POST activity to 'jet_engine_form_booking_submit' from external IP addresses.