Description

Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-27T10:16:39.167Z",
  "pubdate": "2026-08-27T10:16:39.167Z",
  "executiveSummary": "FluentBooking Pro versions 2.2.4 and earlier are susceptible to an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability.\nThis vulnerability stems from a lack of sufficient cryptographic nonce validation or request origin verification in sensitive administrative or functional endpoints.\nThe flaw permits an unauthenticated attacker to induce a victim, such as a site administrator, to execute unauthorized actions on the application without their explicit consent.\nBecause the attack leverages the victim's authenticated session, the impact is highly dependent on the privileges associated with the targeted endpoint, potentially leading to unauthorized configuration changes, booking management, or other sensitive operations.\nSuccessful exploitation requires the attacker to trick an authenticated user into visiting a malicious webpage or interacting with a crafted request while they are logged into the WordPress administrative interface.\nThis vulnerability poses a significant risk to site integrity and management functionality, as it bypasses intended authorization controls through social engineering or client-side request redirection.",
  "technicalDetails": "The vulnerability resides in the request handling logic of FluentBooking Pro versions 2.2.4 and below. The application fails to implement robust CSRF protection mechanisms, such as WordPress nonces (wp_nonce), for its critical actions or administrative hooks.\nCross-Site Request Forgery (CSRF) is an architectural vulnerability where the web application fails to verify the provenance of a state-changing request. In this instance, the plugin does not validate that the incoming HTTP request originated from the legitimate dashboard interface. Consequently, if a user with active administrative or high-level privileges visits an external site controlled by an attacker, that external site can trigger a background HTTP request to the vulnerable FluentBooking Pro plugin.\nThe attack flow proceeds as follows: An attacker identifies a sensitive function within FluentBooking Pro that performs a state-changing action, such as modifying booking settings, deleting entries, or altering plugin configurations. The attacker then constructs a malicious HTML document or script hosted on an external server. This document contains a hidden form or an asynchronous JavaScript (AJAX/Fetch) request targeting the vulnerable plugin endpoint. When an authenticated administrator navigates to the attacker-controlled page, the browser automatically attaches the victim’s session cookies to the forged request due to standard browser cookie handling policies. The FluentBooking Pro plugin processes this request as if it were an intentional, authorized action by the administrator, executing the payload despite the absence of an explicit user interaction with the plugin settings page.\nThe lack of proper request validation exposes these endpoints to unauthorized manipulation. Because the plugin does not enforce unique, time-limited, and context-aware tokens for state-changing operations, there is no defense against cross-site requests that bypass the intended authorization flow. The post-exploitation impact includes the potential to modify booking logic, compromise user data, or perform other administrative actions authorized by the victim’s permission set, thereby undermining the security posture of the WordPress installation."
}