Appointment Booking WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Appointment Booking WordPress plugin, affecting versions prior to 5.6.3. The vulnerability arises because the plugin's central request dispatcher does not properly validate CSRF nonces on several state-changing actions. This oversight allows attackers to perform privileged actions, such as overwriting booking form configurations or disconnecting payment gateways, by exploiting logged-in administrators.

Impact

Exploitation of this vulnerability allows for unauthorized actions to be performed on behalf of a logged-in administrator, potentially leading to misconfigurations in booking settings or payment processing disruptions.

Reproduction

To reproduce this vulnerability, an attacker must first establish a session as an administrator by logging into WordPress. Once authenticated, the attacker can send a request to the admin-ajax.php file, targeting the 'latepoint_route_call' action without including a valid nonce. This request can be crafted to change booking form fields or disconnect a payment gateway. The absence of nonce validation allows the action to be completed successfully, demonstrating the CSRF vulnerability.

Remediation

Users are advised to update the Appointment Booking WordPress plugin to version 5.6.3 or later.