CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.
Explanation of Vulnerability in Simple Terms
WP Time Slots Booking Form versions up to 1.2.30 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the booking form without their knowledge or consent. The vulnerability requires user interaction—the admin must visit the attacker's page—and affects only the integrity of the form's data, not confidentiality or availability.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on the booking form via a malicious webpage.
Potential impact on your site
Booking form settings or data could be modified without your knowledge if an admin visits a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
