PT-2026-51703 · Chuhpl · Book A Room Event Calendar

Swat · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-9721

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the settings form()/update settings() functionality. The plugin's options page handler dispatches on the 'action' POST parameter and calls update settings(), which persists plugin configuration (including the external database host, username, password, prefix, database name, encryption key, and registration page URL) via update option(), without ever generating a nonce field in the settings form or verifying one (no wp nonce field(), check admin referer(), or wp verify nonce() exists anywhere in the plugin). This makes it possible for unauthenticated attackers to modify the plugin's database connection settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-9721

Affected Products

Book A Room Event Calendar

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-9721 · Security Note
• https://plugins.trac.wordpress.org/browser/book-a-room-event-calendar/trunk/bookaroom-events-settings.php#L15 · Note
• https://plugins.trac.wordpress.org/browser/book-a-room-event-calendar/trunk/bookaroom-events-settings.php#L103 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/18b77c9b-6614-4a3f-a003-54567d9c4408?source=cve · Note
• https://plugins.trac.wordpress.org/browser/book-a-room-event-calendar/trunk/bookaroom-events-settings.php#L161 · Note