Description

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-14T05:16:56.113Z",
  "pubdate": "2026-08-14T05:16:56.113Z",
  "executiveSummary": "An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in the Astro Booking Engine plugin for WordPress in all versions up to, and including, 1.4.0. The vulnerability resides within the options deletion functionality due to missing nonce validation.\nThe primary impact of this security flaw is the unauthorized deletion of all configuration parameters and settings associated with the affected plugin, leading to potential denial of service regarding booking operations and loss of operational data.\nThe vulnerability affects the Astro Booking Engine plugin across all vulnerable versions installed on WordPress sites. The risk implications include disruption of service and administrative overhead required to restore lost plugin configurations.\nAn unauthenticated attacker can exploit this weakness by crafting a malicious request and tricking an authenticated site administrator into interacting with it, such as clicking a specially crafted hyperlink or visiting a malicious web page.\nSuccessful exploitation requires user interaction from a privileged user, specifically a site administrator with the capability to manage plugin settings. No direct authentication is required from the attacker, as they leverage the victim's authenticated session.",
  "technicalDetails": "The vulnerability stems from an insecure design pattern within the options deletion functionality of the Astro Booking Engine plugin. Specifically, the codebase fails to implement cryptographic nonce validation or request verification checks to ensure that incoming requests to delete settings originate from a legitimate administrative interface.\nThe vulnerable component handles administrative configuration removal routines. Because these routines lack proper cryptographic token validation, any incoming HTTP request targeting the deletion endpoint is processed without verifying the intent or authorization of the request sender beyond standard session cookies.\nThe affected versions include all releases of the Astro Booking Engine plugin up to, and including, version 1.4.0. The flaw is exposed over the network, allowing external entities to trigger the vulnerable functionality.\nThe exploitation method relies on Cross-Site Request Forgery. The attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious web page or hyperlink containing a forged HTTP request directed to the vulnerable options deletion endpoint of a target WordPress site running the Astro Booking Engine plugin. Second, the attacker induces a site administrator, who currently maintains an active authenticated session with the WordPress administrative dashboard, to click the malicious link or load the weaponized page. Third, the victim's browser automatically includes the valid session cookies along with the forged request to the target site. Fourth, upon receiving the request, the server executes the options deletion functionality because it lacks nonce validation. Finally, all plugin settings are purged, resulting in the loss of configuration data and potential disruption of booking functionalities.\nThe post-exploitation impact is limited to the scope of the missing validation, primarily causing a denial of service through the destruction of plugin configurations, requiring administrative intervention to reconfigure the system."
}