CVE-2024-6660: BookingPress Privilege Escalation Flaw

CVE-2024-6660 Overview

CVE-2024-6660 is a privilege escalation vulnerability in the BookingPress Appointment Booking Calendar Plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.5. The root cause is a missing capability check in the bookingpress_import_data_continue_process_func function. Authenticated attackers with Subscriber-level access or higher can update arbitrary WordPress options and upload arbitrary files. Attackers can weaponize this by changing the default registration role to administrator and enabling open user registration, ultimately gaining full administrative control of the target site. The vulnerability maps to [CWE-862] Missing Authorization and [CWE-280] Improper Handling of Insufficient Permissions or Privileges.

Critical Impact
A Subscriber-level account can escalate to full WordPress administrator by modifying site options and uploading arbitrary files through an unprotected import handler.

Affected Products

Reputeinfosystems BookingPress Appointment Booking Calendar Plugin for WordPress
All versions up to and including 1.1.5
WordPress sites that permit user registration or expose the affected AJAX endpoint

Discovery Timeline

2024-07-17 - CVE-2024-6660 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6660

Vulnerability Analysis

BookingPress exposes an import handler registered as an AJAX action that invokes bookingpress_import_data_continue_process_func. The function processes import payloads and can write files and update WordPress options based on attacker-controlled input. Because the handler omits a capability check such as current_user_can(), any authenticated user can trigger it. Nonce checks alone do not restrict the caller's role, so a logged-in Subscriber can reach privileged code paths intended for administrators. The impact extends beyond data tampering because the handler accepts arbitrary option keys and values, allowing modification of the default_role and users_can_register options. Additional file upload behavior in the import routine enables placement of attacker-controlled files under the WordPress uploads directory.

Root Cause

The root cause is a broken access control pattern. The plugin trusts authentication as sufficient authorization and does not verify that the caller holds the manage_options or equivalent capability required for import operations. The affected code paths are documented in the vendor source at lines 410, 476, and 1491 of class.bookingpress_import_export.php.

Attack Vector

The attack requires network access to wp-admin/admin-ajax.php and a valid Subscriber-or-higher account, which is easily obtained on sites that allow self-registration. The attacker sends a crafted POST request to the AJAX action backing the import continue function. The payload sets arbitrary WordPress options through the underlying update_option calls, flipping users_can_register to 1 and default_role to administrator. The attacker then registers a new account through wp-login.php?action=register and inherits administrator privileges. Alternatively, the file upload path can be used to drop a PHP payload for remote code execution.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress BookingPress Code Review for the vulnerable function references.

Detection Methods for CVE-2024-6660

Indicators of Compromise

Unexpected WordPress administrator accounts, especially recently created via wp-login.php?action=register
Changes to the users_can_register option flipping from 0 to 1
Changes to the default_role option away from subscriber
New PHP files under wp-content/uploads/ matching import staging paths used by BookingPress
POST requests to admin-ajax.php with the bookingpress_import_data_continue_process action from low-privileged sessions

Detection Strategies

Compare current WordPress options against a known-good baseline and alert on drift in default_role, users_can_register, and siteurl
Inspect access logs for authenticated AJAX calls to BookingPress import actions originating from Subscriber accounts
Scan the uploads directory for files with .php, .phtml, or double extensions written after any BookingPress AJAX request
Correlate new user registrations with prior calls to the vulnerable import handler within a short time window

Monitoring Recommendations

Enable WordPress audit logging for user role changes, option updates, and file uploads
Forward web server access logs and WordPress audit events to a central analytics platform for retention and correlation
Alert on any HTTP 200 responses to the vulnerable AJAX action when the requesting user is not an administrator
Track EPSS movement for CVE-2024-6660 to prioritize remediation as exploitation likelihood shifts

How to Mitigate CVE-2024-6660

Immediate Actions Required

Update the BookingPress Appointment Booking Calendar plugin to a version later than 1.1.5 immediately
Audit all administrator accounts and remove any that were not provisioned by legitimate operators
Reset passwords for all administrator accounts and rotate WordPress salts in wp-config.php
Verify that users_can_register and default_role reflect intended values, and disable registration if not required
Scan wp-content/uploads/ for unauthorized PHP files and remove them

Patch Information

The vendor addressed the missing capability check in changeset 3116857. Review the fix in the WordPress BookingPress Changeset Log. Site administrators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Temporarily deactivate the BookingPress plugin until the patched version is installed
Restrict access to wp-admin/admin-ajax.php from untrusted networks via a web application firewall rule
Disable open user registration by setting users_can_register to 0 to remove the escalation path
Enforce least privilege for existing accounts and remove unused Subscriber-level users

bash

# Update BookingPress via WP-CLI and verify site options
wp plugin update bookingpress-appointment-booking
wp option get users_can_register
wp option get default_role
wp option update users_can_register 0
wp option update default_role subscriber