Cross‑Site Request Forgery (CSRF) in Oganro PixelBeds Channel Manager and Hotel Booking Engine allows an attacker to perform requests on behalf of a logged‑in user. An unauthorized actor could initiate or modify hotel bookings, change pricing, or execute other privileged operations without the user’s consent. The weakness is characterized by the absence or defeat of a verification token (nonce) before processing state‑changing requests.

The vulnerability affects the WordPress plugin PixelBeds Channel Manager and Hotel Booking Engine for versions up to and including 1.0, distributed by Oganro.

Based on the description, it is inferred that attackers would need to lure a legitimate user with the appropriate authentication state to a crafted URL that triggers the vulnerable action. The CVSS score of 4.3 reflects a low‑to‑moderate risk, and the EPSS score is less than 1 percent, indicating a very small probability of exploitation in the current environment. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that the impact would be limited to administrators or staff with access to the WordPress dashboard, who could perform privileged operations through the booking engine.