Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update

An unauthenticated attacker can craft a forged HTTP POST request targeting the plugin's settings page, supplying values for `bookaroom_events_db_host`, `bookaroom_events_db_username`, `bookaroom_events_db_password`, `bookaroom_events_db_database`, `bookaroom_events_db_key`, `bookaroom_events_prefix`, and `bookaroom_events_regpage_URL`. Because the plugin lacks any CSRF protection (no nonce validation), the attacker only needs to trick a logged-in site administrator into clicking a link or submitting a form that triggers this request. The `update_settings()` method then writes the attacker-controlled values into the WordPress options table via `update_option()` [ref_id=1][ref_id=2][ref_id=3].

The vulnerability resides in `bookaroom-events-settings.php`. The `settings_form()` handler dispatches on the `action` POST parameter and calls `update_settings()`, which persists plugin configuration via `update_option()` without ever generating a nonce field or verifying one — no `wp_nonce_field()`, `check_admin_referer()`, or `wp_verify_nonce()` exists anywhere in the plugin [ref_id=1][ref_id=2][ref_id=3].

The advisory states that the plugin is missing or has incorrect nonce validation on the `settings_form()`/`update_settings()` functionality. No patch is shown in the bundle; the remediation would require adding `wp_nonce_field()` to the settings form and calling `check_admin_referer()` or `wp_verify_nonce()` before processing the submitted data. Without these additions, any POST request to the settings endpoint is accepted without verifying its origin.