opaxial/CVE-2026-9830

What it is

opaxial/CVE-2026-9830 is a Python script for checking an unauthenticated REST API exposure in BookingPress Pro, a WordPress plugin. The page does not name the endpoint path, the affected versions or the fixed version.

Preconditions / Affected

The script needs Python 3.8 or later and the requests package. Use it only on systems you own or have written permission to assess. The page says not to run it against public, third-party or production systems without that permission.

What to do

Set up an isolated environment and list the options:

python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install requests
python3 main.py --help

Start with the non-invasive check mode, and collect no more data than the approved scope allows.

If you save responses, the JSON files can hold customer names, email addresses, phone numbers, booking dates and service details. The page asks that you:

• store them only in approved encrypted locations;
• limit access to authorized assessment staff;
• redact personal data from tickets, reports and demonstrations;
• delete them according to the engagement's retention policy.

For site owners, the page lists these steps:

• Apply all vendor security fixes to BookingPress Pro and WordPress.
• Confirm that booking REST routes enforce authentication and capability checks.
• Apply least privilege and network controls to administrative and API access.
• Review web and application logs for unusual requests to BookingPress REST endpoints.
• Rotate credentials and follow incident response if exposure is suspected.

After remediation, rerun the authorized check and confirm that unauthenticated requests return no booking or customer records. Keep only the minimum evidence needed to show the fix.

Caveats

The page calls the exposure "reported" and gives no root cause, affected version range or log signatures to search for.