What is the CVSS score of CVE-2025-54036?

CVE-2025-54036 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-54036

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-07-16 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 11:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Cross Site Request Forgery.This issue affects Webba Booking: from n/a through <= 5.1.20.

AnalysisAI

Cross-site request forgery (CSRF) in Webba Appointment Booking plugin (webba-booking-lite) through version 5.1.20 allows unauthenticated attackers to perform unwanted actions on behalf of authenticated users by crafting malicious requests. The vulnerability affects the WordPress plugin and carries a low exploitation probability (EPSS 0.02%, percentile 6%), with no public exploit code identified at the time of analysis.

Technical ContextAI

This is a CSRF vulnerability (CWE-352) in a WordPress appointment booking plugin. CSRF attacks exploit the trust a web application has in a user's browser-when an authenticated user visits a malicious page controlled by an attacker, the browser automatically includes session cookies with requests to the vulnerable application. The plugin likely lacks proper nonce validation (WordPress's primary CSRF mitigation mechanism) on state-changing actions such as appointment creation, modification, deletion, or settings changes. Affected product: Webba Booking (webba-booking-lite) WordPress plugin, CPE context suggests WordPress plugin ecosystem where CSRF protection relies on WordPress nonce functions.

Affected ProductsAI

Webba Booking (webba-booking-lite) WordPress plugin from version 1.0 through version 5.1.20 is affected. The vulnerability was reported by Patchstack on the WordPress plugin repository. No other products or variations are listed as affected.

RemediationAI

Update Webba Booking (webba-booking-lite) to a patched version newer than 5.1.20. Verify the update on the WordPress plugin repository or Patchstack's vulnerability database (https://patchstack.com/database/Wordpress/Plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-5-1-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve). If an immediate update is unavailable, ensure proper nonce validation is implemented on all state-changing operations and audit plugin code for missing nonce checks in form submissions and AJAX handlers. As a temporary mitigation, restrict plugin access to trusted administrators and monitor for suspicious appointment modifications.