CVE-2024-13437: 
WordPress vulnerability analysis and mitigation

The Book a Room WordPress plugin has been identified with a Cross-Site Request Forgery (CSRF) vulnerability, tracked as CVE-2024-13437. The vulnerability affects all versions up to and including 2.9 of the plugin. This security issue was disclosed on February 11, 2025, and involves the plugin's settings page 'bookaroom_Settings' (NVD).

The vulnerability stems from missing or incorrect nonce validation on the 'bookaroom_Settings' page. The CVSS v3.1 base score is 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability requires network access, has low attack complexity, needs no privileges, but requires user interaction (Wordfence Advisory).

The vulnerability allows unauthenticated attackers to modify the plugin's settings through forged requests, provided they can successfully trick a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

The vulnerability requires user interaction in the form of tricking a site administrator into clicking a malicious link. The attack can be executed remotely without requiring authentication (Wordfence Advisory).

As of February 7, 2025, the plugin has been temporarily closed and is not available for download pending a full security review (WordPress Plugin).