CVE-2018-5673

Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the booking-calendar plugin version 2.1.7 for WordPress. The issue is present in the wp-admin/admin.php endpoint, where insufficient validation allows an attacker to forge requests on behalf of an authenticated administrator [1].

Exploitation

An attacker can craft a malicious link or page that, when visited by an authenticated administrator, triggers an unintended action via the vulnerable endpoint. No special network position is required; the attacker only needs to trick the admin into clicking the crafted request [1].

Impact

Successful exploitation allows the attacker to perform any action that the administrator can perform, such as modifying plugin settings, deleting data, or creating new users, leading to a complete compromise of the WordPress site's administrative functions [1].

Mitigation

As of the available references, no specific patch or fixed version has been disclosed. Users should monitor the plugin's official repository for updates and consider disabling the plugin until a fix is applied [1].