The VR Calendar plugin for WordPress contains a flaw caused by missing or incorrect nonce validation in the syncCalendar() function. An attacker who can lure a site administrator into clicking a crafted link or interacting with a forged request can cause that administrator’s browser to submit a synchronous request to the plugin. The result is that the calendar sync routine runs under the administrator’s credentials, potentially exposing or altering calendar data, or causing other unintended state changes within the site. This is a classic CSRF vulnerability that does not require direct authentication to execute.

The affected product is the VR Calendar plugin, version 2.4.7 and all earlier releases, provided by Innate Images, LLC. The plugin runs within a WordPress environment and the vulnerability exists in the WordPress plugin’s administration code.

The CVSS score of 4.3 reflects moderate severity, largely due to the requirement of social engineering for exploitation. The EPSS score is less than 1 %, indicating a very low likelihood that the vulnerability will be actively exploited at this time, and the vulnerability has not been listed in the CISA KEV catalogue. Exploitation would typically involve deceiving an administrator into opening a malicious link that submits a forged request to the syncCalendar() endpoint, thereby triggering the sync operation without credentials.