CVE-2024-6925: 
WordPress vulnerability analysis and mitigation

The TrueBooker WordPress plugin before version 1.0.3 contains a Cross-Site Request Forgery (CSRF) vulnerability. The plugin lacks proper CSRF protection mechanisms when updating its settings, which was discovered and reported by security researcher Bob Matyas (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) with a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The issue stems from the absence of CSRF checks in the settings update functionality, which is tracked as CWE-352 (Cross-Site Request Forgery) (NVD).

This vulnerability could allow attackers to trick authenticated administrators into making unauthorized changes to the plugin's settings through CSRF attacks. The impact is limited to settings modification, with no direct impact on confidentiality or availability (WPScan).

The vulnerability requires user interaction, specifically requiring an authenticated administrator to click on a malicious link or visit a compromised page while logged into the WordPress admin panel (WPScan).

Users should upgrade to TrueBooker version 1.0.3 or later, which includes fixes for this vulnerability (WPScan).