Plugin WordPress Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Vulnerabilidad de Cross Site Request Forgery (CSRF)

The CSRF vulnerability in vcita's plugin allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could result in unauthorized modifications to booking schedules, user profiles, or plugin configurations. For example, an attacker could create fraudulent bookings, cancel existing appointments, or alter the plugin's settings without the user's knowledge or consent. The impact is amplified if the plugin is used in environments with sensitive data or critical scheduling processes. While direct data exfiltration isn't the primary risk, the ability to manipulate bookings and settings can disrupt operations and damage user trust.

Websites utilizing the vcita Online Booking & Scheduling Calendar for WordPress plugin, particularly those with sensitive booking data or critical scheduling processes, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise of one site could lead to attacks against others.

• wordpress / composer / npm:

grep -r 'vcita_meeting_scheduler' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep vcita

• wordpress / composer / npm:

wp plugin update --all

• generic web: Check for unusual booking activity or unexpected changes to plugin settings. Review WordPress access logs for suspicious requests originating from unfamiliar IP addresses.

1. 2025-12-09Disclosure

   disclosure

1. Reservado2025-12-08
2. Publicada2025-12-09
3. Modificada2026-04-28
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-67472 is to upgrade the vcita Online Booking & Scheduling Calendar for WordPress plugin to version 4.6.0 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing a Content Security Policy (CSP) to restrict the sources from which the plugin can load resources. Additionally, ensure that users are educated about the risks of clicking on suspicious links or visiting untrusted websites, as this can help prevent CSRF attacks. While not a direct fix, enabling WordPress's core CSRF protection can offer a layer of defense.

Instalaciones activas

1KNicho

Valoración del plugin