CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in MD Abu Jubayer Hossain Easy Booked – Appointment Booking and Scheduling Management System for WordPress easy-booked allows Cross Site Request Forgery.This issue affects Easy Booked – Appointment Booking and Scheduling Management System for WordPress: from n/a through <= 2.4.5.
Explanation of Vulnerability in Simple Terms
Easy Booked versions up to 2.4.5 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the booking system without the admin's knowledge or consent. This could allow modification or deletion of appointment data.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on bookings or settings via a malicious webpage.
Potential impact on your site
Appointment data could be modified or deleted if an admin visits a malicious link while logged in.
Conditions required to exploit
Admin must visit attacker's webpage while logged into WordPress. No special privileges or complex setup required.
Key dates
External resources
