CVE-2026-8791 Overview
CVE-2026-8791 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Booking System Trafft plugin for WordPress in all versions up to and including 1.0.17. The flaw resides in the set_options AJAX action, which lacks a capability check when the plugin operates in agency mode. Authenticated attackers with Subscriber-level access or above can modify the bookingWebsiteUrl setting and cause the plugin to enqueue an attacker-controlled embed.js script on every front-end page rendering the booking shortcode. The injected script executes in the browser of every visitor, including administrators.
Critical Impact
Subscriber-level attackers can achieve site-wide stored XSS, hijack administrator sessions, and pivot to full site compromise via arbitrary JavaScript execution.
Affected Products
- Booking System Trafft plugin for WordPress, all versions up to and including 1.0.17
- WordPress sites running the plugin in agency mode
- WordPress front-end pages rendering the booking shortcode
Discovery Timeline
- 2026-07-29 - CVE-2026-8791 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-8791
Vulnerability Analysis
The vulnerability originates in the trafftSetOptions() handler registered for the set_options AJAX action. The handler verifies a nonce but performs no capability check before invoking update_option('trafft_option', ['bookingWebsiteUrl' => ...]). The nonce is printed inline on every admin page, including profile.php, so any authenticated user, including Subscribers, can obtain it.
Once the attacker overwrites the bookingWebsiteUrl option, the trafftAdminAssets() function enqueues <bookingWebsiteUrl>/embed.js as a script on every front-end page that renders the booking shortcode. This turns a stored configuration value into a script source loaded in the browser of every site visitor. The resulting persistent script execution enables session theft, forced administrative actions, and arbitrary DOM manipulation.
Root Cause
The root cause is a missing authorization check on a privileged AJAX endpoint. The plugin relies solely on nonce verification, which is a CSRF control rather than an access control mechanism. Because the nonce is exposed on standard admin pages available to Subscribers, nonce verification alone cannot restrict who may write to plugin options.
Attack Vector
An attacker authenticates to the target WordPress site with any account, including Subscriber. The attacker loads an admin page such as profile.php to harvest the exposed nonce, then issues an AJAX request to the set_options action setting bookingWebsiteUrl to an attacker-controlled origin. On subsequent front-end page loads that include the booking shortcode, WordPress enqueues https://attacker.tld/embed.js and executes the attacker's JavaScript in each visitor's browser.
// No verified proof-of-concept code is publicly available.
// See the Wordfence advisory and WordPress plugin source references
// for the vulnerable code paths in trafft.php.
Detection Methods for CVE-2026-8791
Indicators of Compromise
- Unexpected values in the trafft_option WordPress option, specifically a bookingWebsiteUrl pointing to a non-vendor domain.
- Front-end pages loading embed.js from an external, unfamiliar host on URLs that render the booking shortcode.
- POST requests to admin-ajax.php with action=set_options originating from low-privilege user sessions.
Detection Strategies
- Audit the wp_options table for the trafft_option entry and verify the bookingWebsiteUrl matches the legitimate Trafft domain.
- Monitor web server access logs for admin-ajax.php traffic invoking the set_options action from Subscriber or Contributor accounts.
- Inspect rendered front-end HTML for <script> tags referencing untrusted origins served through the booking shortcode.
Monitoring Recommendations
- Alert on modifications to the trafft_option value using WordPress database change auditing tools.
- Track privilege distribution and flag Subscriber accounts issuing administrative AJAX actions.
- Deploy Content Security Policy (CSP) reporting to detect external scripts loaded on booking pages.
How to Mitigate CVE-2026-8791
Immediate Actions Required
- Update the Booking System Trafft plugin to a version later than 1.0.17 once the vendor publishes a patched release.
- Review and reset the bookingWebsiteUrl value under trafft_option to the legitimate Trafft-hosted URL.
- Audit Subscriber-level and higher accounts for unauthorized creation or suspicious activity.
Patch Information
At the time of publication, no fixed version beyond 1.0.17 is referenced in the available advisory data. Refer to the Wordfence Vulnerability Report and the WordPress plugin source for updates on remediation status.
Workarounds
- Deactivate the Booking System Trafft plugin, or disable agency mode, until a patched version is available.
- Restrict new user registrations and remove unused Subscriber accounts to reduce the pool of potential attackers.
- Implement a strict Content Security Policy limiting script-src to trusted origins to block unauthorized embed.js loading.
# Example: locate and inspect the Trafft option via WP-CLI
wp option get trafft_option --format=json
# Reset the bookingWebsiteUrl to the legitimate value if tampered
wp option patch update trafft_option bookingWebsiteUrl "https://legitimate-trafft-domain.example"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
