CVE-2023-4251: 
WordPress vulnerability analysis and mitigation

The EventPrime WordPress plugin before version 3.2.0 contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2023-4251. The vulnerability was discovered and publicly disclosed on October 9, 2023. This security flaw affects the booking creation functionality in the EventPrime event calendar management plugin for WordPress (WPScan).

The vulnerability stems from the absence of proper CSRF protection mechanisms when creating bookings in the EventPrime plugin. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

When exploited, this vulnerability allows attackers to trick authenticated users into creating unwanted bookings through CSRF attacks. The impact is limited to the creation of unauthorized event bookings when logged-in users visit maliciously crafted pages (WPScan).

The vulnerability has been fixed in EventPrime version 3.2.0. Users are advised to update their installations to this version or later to mitigate the risk (WPScan).