Cross-Site Request Forgery Vulnerability in VR Calendar Plugin for WordPress

CVE-2022-3852

What is CVE-2022-3852?

The VR Calendar plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in various functions. This flaw allows unauthenticated attackers to manipulate calendars and plugin settings if they successfully deceive a site administrator into executing a malicious action, such as clicking on a specially crafted link. It is crucial for users of the VR Calendar plugin to ensure they are on the latest version to mitigate potential risks associated with this vulnerability.

References