Cross-Site Request Forgery Vulnerability in Book a Room Event Calendar Plugin for WordPress

CVE-2026-9721

What is CVE-2026-9721?

The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery due to insufficient nonce validation. This flaw allows unauthenticated attackers to modify critical database connection settings, including host, username, password, and database name, if they can trick an administrator into executing a malicious action. The lack of nonce fields in the settings forms means that the plugin does not verify that the requests are genuine, putting sites at risk especially if admin actions are improperly incentivized.

References