WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF)

CVE-2022-36424

What is CVE-2022-36424?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Easy Appointments plugin developed by Nikola Loncar. This flaw affects all versions up to 3.11.9, allowing an attacker to execute unauthorized commands on behalf of authenticated users without their consent. This exploitation can lead to various malicious activities, including unauthorized appointment management and other harmful actions within the site. It is crucial for WordPress users to update the plugin to mitigate these risks.

References