The QuickCal plugin contains a Cross‑Site Request Forgery flaw that can be used to elevate privileges. An attacker who can make a privileged user submit a crafted request to the vulnerable WordPress site can trigger privileged actions normally restricted to administrators. The weakness is identified as CWE‑352, indicating an uncontrolled request with minimal or no verification of the intended target. The impact is a loss of integrity and confidentiality for users and potentially the entire site.

The affected product is the ThemeMove QuickCal – Appointment Booking Calendar for WordPress plugin, versions from the earliest release through version 1.0.15. Any site that has installed a QuickCal instance of these versions is at risk.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation but does not exclude targeted attacks. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been observed as a widely used exploited vulnerability. Exploitation requires an authenticated user with privileged roles to be tricked into executing the malicious request; an unauthenticated user cannot achieve the same effect. The attack vector is standard CSRF, thus the attacker must influence the browser of a privileged user, typically via a deceptive link or embedded form.