EUVD-2026-38658
GHSA-pfhp-jm8f-gx6g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker needs no privileges (PR:N) but requires admin interaction (UI:R); only plugin settings are modified (I:L), with no direct confidentiality or availability impact on the vulnerable system.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the settings_form()/update_settings() functionality. The plugin's options page handler dispatches on the 'action' POST parameter and calls update_settings(), which persists plugin configuration (including the external database host, username, password, prefix, database name, encryption key, and registration page URL) via update_option(), without ever generating a nonce field in the settings form or verifying one (no wp_nonce_field(), check_admin_referer(), or wp_verify_nonce() exists anywhere in the plugin). This makes it possible for unauthenticated attackers to modify the plugin's database connection settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the Book a Room Event Calendar WordPress plugin (all versions through 1.9) allows unauthenticated remote attackers to overwrite sensitive plugin configuration - including external database host, credentials, encryption key, and registration URL - by tricking an authenticated administrator into visiting a malicious page. The vulnerability stems from a complete absence of WordPress nonce mechanisms (no wp_nonce_field(), check_admin_referer(), or wp_verify_nonce()) in both the settings form and its handler, meaning any browser-submitted POST during an active admin session is honored unconditionally. No public exploit has been identified at time of analysis, and the plugin is a niche product, limiting real-world blast radius despite the sensitive nature of the overwriteable fields.
Technical ContextAI
The plugin registers a settings page whose handler (settings_form()/update_settings(), visible in bookaroom-events-settings.php at lines 15, 103, and 161 on WordPress Trac) dispatches on the 'action' POST parameter and then directly calls update_settings(), which persists all submitted values via WordPress's update_option() API. CWE-352 (Cross-Site Request Forgery) describes exactly this class of flaw: a state-changing endpoint that trusts browser-supplied requests without verifying that the request originated from a legitimate form render. WordPress's canonical CSRF defence requires generating a time-limited nonce via wp_nonce_field() in the form and validating it server-side with check_admin_referer() or wp_verify_nonce() before processing any write operation - none of these are present anywhere in the plugin according to the description. The sensitive fields persisted include external database host, username, password, table prefix, database name, an encryption key, and a registration page URL, making a successful CSRF attack particularly impactful beyond a typical settings-change scenario. CPE: cpe:2.3:a:chuhpl:book_a_room_event_calendar:*:*:*:*:*:*:*:*.
RemediationAI
No vendor-released patched version is identified at time of analysis - fix version is not independently confirmed from the provided data. Administrators running the Book a Room Event Calendar plugin should immediately deactivate it via the WordPress plugin manager until a patch is available. If the plugin cannot be deactivated, restrict wp-admin access to known-safe IP ranges via server-level controls (e.g., Nginx allow/deny directives or .htaccess) to reduce the attack surface; note this prevents legitimate remote administration. Deploying a Web Application Firewall (WAF) rule to block unauthenticated or cross-origin POST requests to the plugin's settings endpoint is a partial compensating control but requires WAF tuning and may break legitimate usage. Monitor the WordPress options table for unexpected changes to plugin-specific keys (bookaroom_*) as a detection mechanism. Track the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/18b77c9b-6614-4a3f-a003-54567d9c4408?source=cve and the plugin's WordPress.org page for a patched release.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today