CVE-2025-49966: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Oganro Travel Portal Search Widget for HotelBeds APITUDE API WordPress plugin through version 1.0. The vulnerability was discovered by Chu The Anh (Blue Rock) on May 8, 2025, and was publicly disclosed on June 20, 2025 (Wiz, Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and has received a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability can be exploited without authentication, requiring user interaction (NVD).

This CSRF vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The impact severity is considered low, though it affects all versions of the plugin through 1.0 (Patchstack).

As there is no official fix available and the software is considered abandoned, the recommended mitigation is to remove and replace the plugin with an alternative solution. Deactivating the software alone does not remove the security threat unless a virtual patch is deployed (Patchstack).