CVE-2025-63001 in ND Booking WordPress plugin remains fully exploitable in v7.0.1, four major versions past the "fixed at 3.8" advisory claim. Any unauthenticated visitor can permanently overwrite WooCommerce product prices with a single GET request. Key findings: - CVE-2025-63001 (unauthenticated missing authorization) was filed against ND Booking "up to and including 3.8" but researcher Shikhali Jamalzade confirmed the identical vulnerable code path is unpatched in v7.0.1, the current http://WordPress.org release. The nd_booking_woo_php AJAX handler registers both wp_ajax_ and wp_ajax_nopriv_ variants, calls wc_get_product(), set_regular_price(), set_price(), and save() with zero current_user_can() check and no price validation, writing any attacker-supplied value straight to the database. - The only gate is check_ajax_referer() against a nonce that wp_localize_script() embeds in plain HTML for every anonymous visitor loading the booking search page. A WordPress nonce proves a public page was loaded, nothing more. It provides no authentication here. - Attack chain: load the public booking search page, read nd_booking_ajaxnonce_woo from page source, send one unauthenticated GET to wp-admin/admin-ajax.php with action=nd_booking_woo_php, a valid room post ID in nd_booking_rid, and any price in nd_booking_trip_price. PoC dropped a $500 room to $0.01 with no session cookie. #DFIR_Radar
Post summary
The post confirms CVE-2025-63001 remains vulnerable on the latest plugin version, provides a detailed exploitation path, and references a working PoC, but does not report active or in-the-wild attacks.