Cross-Site Request Forgery Vulnerability in OTA Sync Booking Engine Widget Plugin

CVE-2024-7647

Summary

The OTA Sync Booking Engine Widget for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that affects all versions up to and including 1.2.7. This vulnerability arises from inadequate or absent nonce validation in the otasync_widget_settings_fnc() function. As a result, unauthenticated attackers can manipulate plugin settings and potentially execute malicious scripts through forged requests. The exploitation requires the attacker to deceive a site administrator into performing an action, such as clicking on a specially crafted link, thereby allowing unauthorized alterations to the plugin's configuration.

References