Cross-Site Request Forgery Vulnerability in ThimPress WP Hotel Booking Plugin
CVE-2025-47448

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Hotel Booking
Vendor
CVE Published:
7 May 2025

What is CVE-2025-47448?

A Cross-Site Request Forgery (CSRF) vulnerability in the ThimPress WP Hotel Booking plugin poses significant security risks, allowing attackers to trick users into executing unwanted actions on the website. This vulnerability affects all WP Hotel Booking versions up to 2.1.9, potentially compromising the integrity of user sessions and leading to unauthorized transactions.

Affected Version(s)

WP Hotel Booking <= 2.1.9

References

https://patchstack.com/database/wordpress/plugin/wp-hotel...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucky_buddy (Patchstack Alliance)
.