CVE-2026-8791: 
WordPress vulnerability analysis and mitigation

CVE-2026-8791 is a Stored Cross-Site Scripting (XSS) vulnerability in the Booking System Trafft plugin for WordPress, affecting all versions up to and including 1.0.17. The flaw exists in the set_options AJAX action when the plugin operates in agency mode, where a missing capability check allows low-privileged authenticated users to modify the bookingWebsiteUrl setting to an attacker-controlled origin. Disclosed on July 29, 2026, it carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The trafftSetOptions() AJAX handler verifies a nonce, but that nonce is printed inline on every WordPress admin page (including profile.php), making it accessible to any authenticated user. Because no capability check is performed before calling update_option('trafft_option', ['bookingWebsiteUrl' => ...]), a Subscriber-level user can overwrite this setting with an attacker-controlled URL. The trafftAdminAssets() function then enqueues <bookingWebsiteUrl>/embed.js as a script on every front-end page rendering the booking shortcode, causing arbitrary JavaScript to execute in all visitors' browsers (GitHub Advisory, WordPress Trac).

Any authenticated attacker with Subscriber-level access or above can redirect the embed script URL to an attacker-controlled server, causing malicious JavaScript to execute in the browsers of all site visitors, including administrators. This enables session hijacking, credential theft, admin account takeover, defacement, or further malware distribution. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to all users of the affected WordPress site (GitHub Advisory, Wordfence).

1. Obtain Authenticated Access: Register or log in to the target WordPress site with at least a Subscriber-level account.
2. Retrieve the Nonce: Visit any WordPress admin page (e.g., /wp-admin/profile.php) while authenticated; the nonce for the set_options AJAX action is printed inline in the page source.
3. Identify Agency Mode: Confirm the Booking System Trafft plugin is operating in agency mode, which enables the vulnerable set_options AJAX action.
4. Send Malicious AJAX Request: Craft and send an HTTP POST request to /wp-admin/admin-ajax.php with action=set_options, the retrieved nonce, and bookingWebsiteUrl set to an attacker-controlled domain (e.g., https://attacker.example.com).
5. Host Malicious Script: Place a malicious JavaScript payload at https://attacker.example.com/embed.js (e.g., a cookie-stealing script or admin account creation script).
6. Trigger Execution: The plugin's trafftAdminAssets() function will now enqueue the attacker's script on every front-end page rendering the booking shortcode, executing the payload in the browsers of all site visitors including administrators (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with action=set_options from low-privileged user accounts; unexpected changes to the trafft_option entry in the WordPress wp_options database table.
• Database: The bookingWebsiteUrl value in wp_options (option name trafft_option) pointing to an external or unfamiliar domain rather than the site's own booking URL.
• Network: Outbound script loads from front-end pages to unexpected external domains for embed.js; browser requests to attacker-controlled origins from site visitor sessions.
• File System: No direct file system artifacts expected, but review server-side logs for unusual AJAX action calls originating from subscriber-level accounts (Wordfence).

Update the Booking System Trafft plugin to a version newer than 1.0.17, which addresses the missing capability check. As an interim measure, restrict user registrations and audit existing accounts to ensure only trusted users hold Subscriber-level or higher roles. Additionally, monitor the trafft_option entry in the WordPress wp_options table for unauthorized changes to the bookingWebsiteUrl parameter, and consider disabling the plugin until a patch is applied if the site allows open user registration (GitHub Advisory, Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the threat intelligence entry on July 29, 2026. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence and GitHub Advisory disclosures has been observed at this time (Wordfence, GitHub Advisory).