Medium · 5.4 CVE-2023-24388 EUVD-2023-28444GHSA-wm7h-448h-cg4j

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Published Feb 17, 2023 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: wpdevart Product: Booking calendar, Appointment Booking System

Description

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).

Affected products

Vendor	Product	Affected	Fixed
WpDevArt	Booking calendar, Appointment Booking System	≤ 3.2.3	—

References

https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-cross-site-request-forgery-csrf?_s_id=cve vdb-entry