Booked WordPress Plugin EUVD-2026-41303

The target user must be authenticated to the WordPress site (holding an active session cookie with sufficient privileges to perform the targeted Booked plugin action) at the time they visit the attacker-controlled page. The CVSS UI:R metric confirms victim interaction is required - passive exploitation without the victim clicking or visiting a link is not possible. The Booked plugin must be installed and active on the target WordPress instance running version 3.0.0 or earlier. No special server configuration is required beyond the plugin being installed. Exploitation is limited by the need for a social engineering step to lure the authenticated user; fully opportunistic scanning-style exploitation is not applicable.

CVSS 6.5 Medium with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a network-reachable attack requiring no privileges to stage (PR:N) but mandating victim interaction (UI:R), which meaningfully limits exploitation compared to fully passive vectors. The A:H with no confidentiality or integrity impact suggests the actionable harm is availability disruption - likely mass deletion of bookings or plugin data - rather than account takeover or data exfiltration. No EPSS score was provided; KEV status is not listed, confirming no known active exploitation. No POC is referenced. Real-world risk is moderate: the attack is easy to stage once a social-engineering lure is crafted, but the impact is bounded to availability of the booking plugin functionality rather than broader WordPress compromise. Defenders at sites relying heavily on Booked for operational scheduling should treat this as higher priority than the medium CVSS score alone suggests.

An attacker crafts a malicious webpage containing hidden HTML forms or JavaScript that automatically submits forged HTTP requests to the target WordPress site's Booked plugin endpoints. When an authenticated WordPress administrator or editor visits the attacker's page - via phishing email, social media link, or malvertising - their browser silently sends the forged request using their active session cookies, causing the plugin to execute the destructive action (such as deleting all appointments) without any CSRF token validation rejecting it.