Booknetic WordPress Plugin Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability has been identified in the Booknetic WordPress plugin, affecting versions prior to 4.1.5. The issue arises because the plugin does not implement CSRF protection when creating Staff accounts. This lack of validation could enable attackers to exploit logged-in administrators by forcing them to add arbitrary Staff members.

Impact

Exploitation of this vulnerability could lead to unauthorized Staff accounts being created, potentially allowing attackers to gain additional privileges or access within the WordPress site.