CVE-2022-45824 MEDIUM

CVE-2022-45824: WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Advanced Booking Calendar
Product Advanced Booking Calendar
Weakness CWE-352 · CSRF
Published December 5, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

Advanced Booking Calendar versions up to 1.7.1 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the calendar without their knowledge. The attacker cannot read sensitive data, but can modify calendar settings or availability. A patched version has not been publicly identified.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into modifying calendar settings or availability by visiting a malicious webpage.

Potential impact on your site

04Site Impact

Calendar bookings or settings could be altered without admin consent if an admin visits a malicious link.

Conditions required to exploit

05Prerequisites

Admin must be logged in and visit attacker-controlled webpage; no special privileges or network access required.

Key dates

06Disclosure timeline

December 5, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57786 WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 CVE-2026-12002 Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension