CVE-2026-9830 BookingPress Pro API Assessment PoC

This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data.

Authorization Required

Use this project only against systems you own or are explicitly authorized to assess. Do not run it against public, third-party, or production systems without written permission. Handle any retrieved booking data as sensitive personal information.

Scope

The script:

• Normalizes a supplied WordPress target URL.
• Checks the BookingPress Pro REST API endpoint for an exposed booking response.
• Can save a returned response locally when invoked by an authorized assessor.
• Supports timeout, proxy, user-agent, booking ID, and date filtering configuration.

Requirements

• Python 3.8 or later
• The requests package

Install the Python dependency in an isolated environment:

python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install requests

Usage

Review the available options locally:

python3 main.py --help

For an authorized validation, provide the target through the command-line interface. Start with the non-invasive check mode and avoid collecting or retaining data beyond the approved assessment scope.

Output and Data Handling

The tool can write API responses to JSON files. Those files may contain customer names, email addresses, telephone numbers, booking dates, and service details.

• Store outputs only in approved encrypted locations.
• Limit access to authorized assessment staff.
• Redact personal data from tickets, reports, and demonstrations.
• Delete assessment artifacts according to the engagement's retention policy.

Remediation Guidance

Site owners and BookingPress administrators should:

1. Upgrade BookingPress Pro and WordPress to supported versions with all vendor security fixes applied.
2. Confirm that booking-related REST routes enforce authentication and capability checks before returning customer data.
3. Restrict administrative and API access using least privilege and, where appropriate, network controls.
4. Review web and application logs for unusual requests to BookingPress REST endpoints.
5. Rotate credentials and follow the organization’s incident-response process if exposure is suspected.

Verification

After remediation, repeat the authorized check and confirm that unauthenticated requests cannot return booking or customer records. Record only the minimum evidence needed to demonstrate the fix.

Disclaimer

This code is provided for defensive security testing, verification, and research. The repository maintainer and contributors are not responsible for unauthorized use.