What is the CVSS score of EUVD-2025-210726?

EUVD-2025-210726 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Astro Booking Engine EUVD-2025-210726

| CVE-2025-10308 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-14 Wordfence

GHSA-rgf3-297c-wwgm

WordPress CSRF Wordpress Plugin Astro Booking Engine

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF requiring no attacker privileges (PR:N) but mandatory admin interaction (UI:R); impact is bounded to settings deletion (I:L) with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 05:30 vuln.today

CVE Published

Aug 14, 2026 - 04:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-site request forgery in the Astro Booking Engine WordPress plugin (all versions ≤ 1.4.0) enables unauthenticated remote attackers to wipe all plugin settings by tricking an authenticated administrator into following a malicious link. The root cause is missing nonce validation on the options-deletion handler - a textbook CWE-352 pattern - allowing the plugin to execute state-changing operations without confirming request origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified, positioning this as a legitimate remediation item rather than an emergency response priority.

Technical ContextAI

The Astro Booking Engine is a WordPress plugin (CPE: cpe:2.3:a:alian:astro_booking_engine:*:*:*:*:*:*:*:*) developed by vendor 'alian' for managing booking workflows within WordPress installations. WordPress's security model requires plugins to validate nonce tokens (via wp_verify_nonce or check_admin_referer) on every state-changing admin action to confirm that requests originate from the legitimate admin interface rather than a forged third-party page. CWE-352 (Cross-Site Request Forgery) results when this verification step is absent, allowing an attacker's page to silently issue requests that the victim's browser authenticates with active session cookies. The Wordfence advisory and plugin repository browser confirm the vulnerable code resides in includes/tabs/tab-support.php (visible in the 1.3.0 tag at line 6), where the options-deletion handler performs no nonce check before executing the destructive action.

RemediationAI

Upgrade the Astro Booking Engine plugin to a version beyond 1.4.0 as soon as a tagged release incorporating the fix becomes available in the WordPress plugin repository; the upstream remediation is captured in changeset 3638105 (https://plugins.trac.wordpress.org/changeset/3638105/astro-booking-engine), but a specific patched release version number was not confirmed in the available input data, so the plugin repository should be monitored for a tagged update. If an immediate upgrade is unavailable, restrict access to the WordPress admin area (wp-admin) by IP allowlist at the server or WAF layer, which prevents attackers from targeting administrators from unauthenticated external contexts - the trade-off is added operational complexity for legitimate remote administrators. An additional compensating control is to enforce strict HTTP Referer header checking for admin POST endpoints at the WAF, though this may cause false positives in environments with privacy-focused proxies or browsers that strip Referer headers. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0b13b4-b604-4514-845e-05a3b8858c66 should be monitored for patch version confirmation.