CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking.This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking: from n/a through 4.5.33.
Explanation of Vulnerability in Simple Terms
The Webba Booking plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 4.5.33. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the booking system without the admin's knowledge or consent. The vulnerability requires the victim to visit the attacker's page while authenticated to the WordPress site.
What an attacker can do
Perform unwanted actions on the booking system by tricking an authenticated admin into visiting a malicious webpage.
Potential impact on your site
Attackers can modify booking settings, create fake bookings, or alter calendar configurations without your permission.
Conditions required to exploit
Victim must be logged into WordPress as an administrator and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
