CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
VR Calendar versions 2.4.7 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions within the calendar application without the administrator's knowledge or consent. The attacker has no direct access to the site and relies on social engineering to trick the admin into visiting the malicious page.
What an attacker can do
Perform unwanted actions in VR Calendar on behalf of a logged-in administrator without their knowledge.
Potential impact on your site
An attacker could modify calendar settings, delete events, or change configurations by tricking admins into visiting malicious links.
Conditions required to exploit
Administrator must be logged into the site and visit an attacker-controlled webpage while authenticated.
Key dates
External resources
