CVE-2025-67472
📋 TL;DR
This CSRF vulnerability in vcita's WordPress booking plugin allows attackers to trick authenticated administrators into performing unintended actions, such as changing plugin settings or potentially compromising the WordPress site. It affects all WordPress sites running the vcita Online Booking & Scheduling Calendar plugin version 4.5.5 or earlier.
💻 Affected Systems
- Online Booking & Scheduling Calendar for WordPress by vcita
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover if attacker can trick admin into executing malicious requests that modify critical WordPress settings or install backdoors.
Likely Case
Unauthorized changes to booking system settings, appointment data manipulation, or plugin configuration changes leading to service disruption.
If Mitigated
No impact if proper CSRF tokens are implemented and validated by the plugin.
🎯 Exploit Status
CSRF attacks are well-understood and easy to weaponize once the vulnerable endpoints are identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 4.5.5
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Online Booking & Scheduling Calendar for WordPress by vcita'. 4. Click 'Update Now' if available, or download latest version from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Implement CSRF Protection via Security Plugin
allUse WordPress security plugins that add CSRF protection globally
Restrict Admin Access
allLimit administrator access to trusted networks only
🧯 If You Can't Patch
- Disable the vcita plugin temporarily until patching is possible
- Implement strict Content Security Policy (CSP) headers to restrict cross-origin requests
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for vcita Online Booking & Scheduling Calendar versionCheck Version:
wp plugin list --name='Online Booking & Scheduling Calendar for WordPress by vcita' --field=versionVerify Fix Applied:
Verify plugin version is > 4.5.5 in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to vcita plugin endpoints from same IP with different referrers
- Unexpected changes to booking settings without corresponding admin actions
Network Indicators:
- Cross-origin requests to /wp-admin/admin-ajax.php with vcita-specific actions
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php") AND (query_string="action=vcita_*") AND referrer_domain!=site_domain