CVE-2026-57747 MEDIUM

CVE-2026-57747: WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Themerex

Product Booked

Weakness CWE-352 · CSRF

Published July 2, 2026

Last update July 2, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Booked versions up to 3.0.0 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unwanted actions on behalf of a logged-in user. The vulnerability requires user interaction—typically clicking a malicious link or visiting a compromised page. An attacker cannot read data but can disrupt site availability or modify settings.

What an attacker can do

03Attacker Capabilities

Perform actions on behalf of a logged-in user without their knowledge, such as disrupting availability or changing settings.

Potential impact on your site

04Site Impact

Users' accounts can be manipulated to perform unintended actions; site availability or configuration may be disrupted.

Conditions required to exploit

05Prerequisites

A logged-in user must click a malicious link or visit an attacker-controlled page while authenticated to Booked.

Key dates

06Disclosure timeline

July 2, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-57747 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities