PT-2026-51703 · Chuhpl · Book A Room Event Calendar
Swat
·
Publicado
2026-06-24
·
Atualizado
2026-06-24
·
CVE-2026-9721
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the settings form()/update settings() functionality. The plugin's options page handler dispatches on the 'action' POST parameter and calls update settings(), which persists plugin configuration (including the external database host, username, password, prefix, database name, encryption key, and registration page URL) via update option(), without ever generating a nonce field in the settings form or verifying one (no wp nonce field(), check admin referer(), or wp verify nonce() exists anywhere in the plugin). This makes it possible for unauthenticated attackers to modify the plugin's database connection settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Book A Room Event Calendar