Cross-Site Request Forgery Vulnerability in Astro Booking Engine Plugin for WordPress

CVE-2025-10308

What is CVE-2025-10308?

The Astro Booking Engine plugin for WordPress has a vulnerability that allows unauthorized attackers to exploit missing nonce validation in the options deletion functionality. This flaw can be exploited through crafted requests, enabling an attacker to delete all plugin settings if they successfully prompt an administrator to interact with a malicious link. Users of versions 1.4.0 and earlier are especially at risk, making it crucial to implement security measures to mitigate potential attacks.

References