A Cross‑Site Request Forgery flaw in the Themespride Advanced Appointment Booking & Scheduling plugin allows an attacker to trick a logged‑in user into performing state‑changing operations without the user’s intent. The vulnerability stems from missing or inadequate CSRF validation on relevant requests. An attacker can potentially create, modify or delete appointments, or otherwise alter scheduling data, thereby disrupting business processes or impersonating legitimate users.

Versions of the Themespride Advanced Appointment Booking & Scheduling plugin up to and including 2.1 are affected. The plugin is distributed to WordPress sites as a plugin package and is used for appointment scheduling and booking.

The CVSS score of 4.3 classifies the flaw as medium severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild at present. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require an attacker to lure a legitimate user or administrator to a malicious site or URL that submits forged requests, exploiting the missing CSRF protections.