The vulnerability is a missing CSRF check in the delete customer endpoint of the WPBookit plugin up to version 1.0.7. Without this protection, an unauthenticated attacker can trick an authenticated user into visiting a crafted link or embedding a request, resulting in the deletion of the targeted customer record. This causes irreversible data loss, impacting record integrity and potentially violating data retention and compliance requirements.

WordPress plugin WPBookit, versions up to 1.0.7. The issue applies to all releases ≤ 1.0.7; the plugin is available in the WordPress repository and may be installed on any WordPress site.

The CVSS score of 6.5 indicates a moderate severity with medium impact. The EPSS score of < 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in CISA KEV, but the lack of CSRF guard makes the attack path simple – an attacker only needs to host a malicious page or send a crafted HTTP request to an authenticated user's browser. The attack is feasible without any network access to the WordPress admin interface and does not require additional privileges. Thus, while the likelihood is low, the potential loss of customer data warrants timely remediation.