CVE-2020-13426: 
WordPress vulnerability analysis and mitigation

The Multi-Scheduler plugin version 1.0.0 for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2020-13426). The vulnerability was discovered on May 21, 2020, and affects the forms presented by the plugin, which lack proper CSRF protection mechanisms. The plugin was designed to manage event reservations, including appointments, meetings, and interviews, with calendar functionality and user management capabilities (CX Security, Infayer).

The vulnerability stems from the absence of anti-CSRF tokens in forms that handle user deletion and creation operations. This security oversight places complete trust in user actions without proper validation. The CVSS v3.1 base score is 6.5 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating a network-accessible vulnerability requiring user interaction (NVD).

The vulnerability allows attackers to force authenticated users to perform unintended actions, specifically the deletion of user records from the 'professional' table in the application database when the target user ID is known. This can lead to unauthorized deletion of user data without the victim's consent (CX Security, Infayer).

Proof of Concept (PoC) exploits have been published demonstrating how an attacker can craft a malicious form that, when submitted by an authenticated user, triggers the unauthorized deletion of user records. The vulnerability has been documented in multiple security databases and exploit repositories (Exploit DB, Packet Storm).

The plugin has been closed and is no longer available for download as of June 1, 2020, due to this security issue. Users are advised to remove the plugin from their WordPress installations to prevent potential exploitation (WordPress).