CVE-2025-67472: CSRF in vcita Online Booking Calendar

The CSRF vulnerability in vcita's plugin allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could result in unauthorized modifications to booking schedules, user profiles, or plugin configurations. For example, an attacker could create fraudulent bookings, cancel existing appointments, or alter the plugin's settings without the user's knowledge or consent. The impact is amplified if the plugin is used in environments with sensitive data or critical scheduling processes. While direct data exfiltration isn't the primary risk, the ability to manipulate bookings and settings can disrupt operations and damage user trust.

1. Reserved2025-12-08
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67472 is to upgrade the vcita Online Booking & Scheduling Calendar for WordPress plugin to version 4.6.0 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing a Content Security Policy (CSP) to restrict the sources from which the plugin can load resources. Additionally, ensure that users are educated about the risks of clicking on suspicious links or visiting untrusted websites, as this can help prevent CSRF attacks. While not a direct fix, enabling WordPress's core CSRF protection can offer a layer of defense.