The Book a Room Event Calendar plugin for WordPress contains a CSRF vulnerability in all releases through 1.9. The plugin’s settings form omits nonce generation and validation, so an attacker can craft a forged request that updates the plugin’s configuration fields—database host, username, password, encryption key, and registration page URL—without any authentication. This allows an unauthenticated attacker to change the database connection parameters, potentially hijacking the site’s data layer, altering stored data, or redirecting traffic to a malicious database instance. The primary impact is unauthorized modification of critical configuration that undermines confidentiality and integrity of the site’s data.

The affected product is the Book a Room Event Calendar WordPress plugin distributed by chuhpl. All versions up to and including 1.9 are vulnerable. No additional vendor or product information is available.

The CVSS score is 4.3, indicating a moderate risk level. No EPSS score is provided, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires the targeted site administrator to act on a malicious link or form, so it is a User‑Interaction attack. Because the vulnerability allows persistent changes to configuration, an attacker who succeeds can maintain a foothold on the site. Given the moderate CVSS and the need for user interaction, the overall risk is moderate but significant for sites that rely on this plugin for event management.