The vulnerability is an unauthenticated Cross Site Request Forgery flaw in the Eagle Booking plugin version 1.3.4.3 and earlier. An attacker can craft requests that the victim’s browser will unknowingly send while authenticated, allowing the attacker to perform booking‑management actions without permission. The weakness resides in CWE‑352, where request validation fails to verify token integrity, enabling unauthorized state changes that compromise the integrity of booking data.

WordPress sites running the Eagle Booking plugin, version 1.3.4.3 or older, provided by Eagle-Themes.

The CVSS score of 8.8 indicates high severity, though the EPSS score is not available and the issue is not listed in the KEV catalog. The attack vector is likely browser‑based, relying on victim interaction with the site; no authentication is required for exploitation. Given the lack of an official patch notice in the public referenced advisory, sites using the affected plugin version remain at significant risk until the plugin is updated or mitigations applied.