CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
Explanation of Vulnerability in Simple Terms
The vcita Online Booking & Scheduling Calendar plugin for WordPress versions 4.5.5 and earlier contains a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. The vulnerability requires user interaction but does not require authentication.
What an attacker can do
Perform unwanted actions on the site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
An attacker could modify plugin settings, create bookings, or change calendar configurations without your permission.
Conditions required to exploit
A logged-in WordPress administrator must visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
