The Webba Appointment Booking Webba Booking plugin for WordPress contains a CSRF weakness (CWE-352) that lets an attacker lure an authenticated user into performing unintended booking actions. The flaw does not provide remote code execution or denial of service but can lead to unauthorized appointment creation, modification, or cancellation, potentially altering service schedules or privacy of customers.

The vulnerability is present in all releases of the Webba Booking plugin up to and including version 5.1.20. No older supported version is listed as affected.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would likely exploit it by sending a forged request from a malicious link, email, or embedded form to a logged‑in user’s browser. Relying on the absence of CSRF tokens in the plugin’s request handling is the main exploitation vector.