EUVD-2026-44871
GHSA-fhhf-9f5f-hv7p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attacker needs no account (PR:N), victim admin must interact (UI:R); impact limited to config integrity and payment-gateway availability, no data disclosure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.
AnalysisAI
Cross-Site Request Forgery in the Appointment Booking Plugin for WordPress (versions before 5.6.3) allows an unauthenticated attacker to perform privileged administrative actions - including overwriting the booking-form configuration and disconnecting the connected payment gateway - by tricking a logged-in administrator into clicking a malicious link or visiting an attacker-controlled page. The root cause is absent CSRF nonce validation across multiple state-changing actions handled by the plugin's central request dispatcher. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS sits at 0.10% (1st percentile), indicating negligible observed exploitation activity and no CISA KEV listing at time of analysis.
Technical ContextAI
WordPress provides a built-in nonce mechanism (wp_verify_nonce / check_admin_referer) as the primary CSRF defense for admin-facing AJAX and form actions. CWE-352 (Cross-Site Request Forgery) arises when state-changing HTTP requests are processed without verifying that they originated from the legitimate admin UI session. The Appointment Booking Plugin routes multiple privileged operations through a single 'central request dispatcher' endpoint, and none of these actions validate a CSRF token, meaning any in-scope admin session can be abused by a third-party origin. The CPE string (cpe:2.3:a:unknown:appointment_booking_plugin:*:*:*:*:*:*:*:*) reflects that the vendor slug is not yet registered in NVD, but the affected range is confirmed as all versions below 5.6.3. The affected actions include booking-form configuration writes and payment gateway disconnection - both high-value targets for sabotage.
RemediationAI
The vendor-released patch is version 5.6.3 of the Appointment Booking Plugin; administrators should update immediately via the WordPress plugin dashboard or by downloading from the official repository. The WPScan advisory at https://wpscan.com/vulnerability/84e936b8-1978-4dc3-aa40-5ce49bfdc445/ confirms the fix is available. If immediate patching is not feasible, a compensating control is to restrict access to the WordPress admin panel to trusted IP ranges via server-level rules (e.g., nginx allow/deny directives or .htaccess), which reduces the attack surface by ensuring only known-safe networks can hold the active admin sessions that CSRF requires. Note that IP restriction alone does not eliminate CSRF risk for admins working from approved addresses, so it is a partial mitigation only. There are no known configuration-level switches within the plugin to disable the vulnerable dispatcher selectively.
More in Appointment Booking Plugin
View allSame weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today