CVE-2024-53753: CultBooking CSRF and XSS Vulnerability

CVE-2024-53753 Overview

CVE-2024-53753 is a Cross-Site Request Forgery (CSRF) vulnerability in the CultBooking Hotel Booking Engine WordPress plugin (cultbooking-booking-engine). The flaw affects all versions up to and including 2.1. Successful exploitation enables an attacker to chain the CSRF weakness into a Stored Cross-Site Scripting (XSS) attack. An attacker tricks an authenticated administrator into submitting a crafted request, which injects persistent JavaScript into the plugin's stored data. The injected payload then executes in the browser of any user who views the affected page, allowing session theft, administrative account takeover, or further compromise of the WordPress site.

Critical Impact
An unauthenticated attacker can leverage CSRF to plant persistent JavaScript that runs in administrator browsers, leading to site takeover.

Affected Products

CultBooking Hotel Booking Engine WordPress plugin (cultbooking-booking-engine)
All versions from n/a through 2.1
WordPress installations using the vulnerable plugin

Discovery Timeline

2024-12-02 - CVE-2024-53753 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-53753

Vulnerability Analysis

The vulnerability is classified under [CWE-352] (Cross-Site Request Forgery). The plugin processes state-changing requests without verifying a valid anti-CSRF token. As a result, the server cannot distinguish between a legitimate administrative action and a forged request originating from an attacker-controlled page. Because the targeted endpoint also fails to sanitize or encode user-supplied input before storing it, the CSRF flaw escalates into a Stored XSS condition. The attack requires user interaction, typically an authenticated administrator visiting a malicious or compromised page.

Root Cause

The root cause is the absence of CSRF protection on a request handler that accepts and persists user-controlled input. WordPress provides wp_nonce_field() and check_admin_referer() primitives for this purpose, but the affected handler in cultbooking-booking-engine does not enforce them. The handler also lacks output encoding when rendering the stored value, which permits the JavaScript payload to execute in the rendered DOM.

Attack Vector

The attack vector is network-based and requires victim interaction. An attacker hosts a page containing an auto-submitting HTML form or fetch request that targets the vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator visits the attacker's page, the browser sends the forged request with valid session cookies. The plugin processes the request, stores the attacker-controlled payload, and later renders it to other site users, executing the injected script in their browser context. No verified public proof-of-concept code is available; see the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-53753

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes stored in plugin database tables or options associated with cultbooking-booking-engine.
Outbound HTTP requests from administrator browsers to unknown domains shortly after visiting the WordPress admin interface.
New or modified WordPress administrator accounts that were not provisioned by legitimate workflows.

Detection Strategies

Audit plugin-managed database entries for HTML and JavaScript syntax in fields that should contain plain text.
Inspect WordPress access logs for POST requests to plugin endpoints lacking a valid _wpnonce parameter or referer header.
Review browser Content Security Policy (CSP) violation reports for inline script executions originating from plugin-rendered pages.

Monitoring Recommendations

Monitor administrator session activity for anomalous actions following navigation to external sites.
Alert on creation or modification of privileged WordPress users and on changes to plugin or theme files.
Forward WordPress and web server logs to a centralized analytics platform to correlate CSRF and XSS indicators across sessions.

How to Mitigate CVE-2024-53753

Immediate Actions Required

Identify all WordPress installations running the cultbooking-booking-engine plugin at version 2.1 or earlier.
Deactivate the plugin until a vendor-supplied patched release is available and verified.
Force a password reset and session invalidation for all WordPress administrator accounts on affected sites.
Review stored plugin data and the WordPress user table for signs of prior exploitation.

Patch Information

At the time of NVD publication, the Patchstack Vulnerability Report lists the issue as affecting versions up to and including 2.1. Administrators should monitor the WordPress plugin repository and the vendor's advisory channel for a fixed release and apply it as soon as it is available.

Workarounds

Restrict access to the WordPress administrative interface using IP allow-listing or VPN-based controls.
Deploy a web application firewall (WAF) rule that blocks POST requests to plugin endpoints lacking a valid _wpnonce parameter.
Enforce a strict Content Security Policy that disallows inline scripts and unknown third-party script sources.
Train administrators to log out of WordPress sessions before browsing untrusted sites to reduce CSRF exposure.

bash

# Example: enforce nonce verification at the WAF layer (ModSecurity rule sketch)
SecRule REQUEST_URI "@contains /wp-admin/admin-post.php" \
  "chain,deny,status:403,id:1005301,msg:'Missing WordPress nonce on plugin endpoint'"
  SecRule &ARGS:_wpnonce "@eq 0"