CVE-2025-67472: 
WordPress vulnerability analysis and mitigation

CVE-2025-67472 is a Cross-Site Request Forgery (CSRF) vulnerability in the "Online Booking & Scheduling Calendar for WordPress by vcita" plugin (slug: meeting-scheduler-by-vcita). It affects all plugin versions up to and including 4.5.5, and was reported by researcher Mika on October 13, 2025, with public disclosure on November 12, 2025 via Patchstack. The CVE was published to NVD on December 9, 2025. NVD assigns a CVSS v3.1 base score of 8.8 (High), while Patchstack rates it 4.3 (Medium) using a WordPress-specific scoring methodology (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), arising from the plugin's failure to properly validate or enforce CSRF tokens on sensitive administrative requests. An unauthenticated attacker can craft a malicious web page or link containing a forged HTTP request targeting the plugin's administrative endpoints; when an authenticated WordPress administrator visits the attacker-controlled page, the browser automatically submits the forged request with the victim's session credentials. No special privileges are required by the attacker, but user interaction from an authenticated user is necessary for exploitation (Patchstack).

Successful exploitation allows an attacker to force authenticated WordPress administrators to perform unauthorized administrative actions on the affected site, including potential modification of plugin settings, booking data, or other site configurations. The NVD CVSS assessment rates confidentiality, integrity, and availability impacts all as High, meaning a successful attack could result in data exposure, unauthorized content or configuration changes, and potential service disruption. The attack scope is limited to the affected WordPress installation, but administrative-level compromise could enable further lateral movement within the site environment (Patchstack).

There is no known public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000080 (approximately 0.008%), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite CSRF vulnerabilities of this class sometimes being used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the vcita Online Booking & Scheduling Calendar plugin at version 4.5.5 or earlier, using tools like WPScan or by inspecting plugin directories exposed via the target site.
2. Identify target action: Determine which administrative plugin endpoints (e.g., settings update, booking configuration) lack CSRF token validation.
3. Craft malicious page: Create an HTML page containing a hidden form or JavaScript that auto-submits a forged POST request to the vulnerable plugin endpoint with attacker-chosen parameters (e.g., modifying plugin settings or admin email).
4. Deliver to victim: Trick an authenticated WordPress administrator into visiting the malicious page via phishing email, social engineering, or a compromised third-party site.
5. Achieve unauthorized action: The victim's browser automatically submits the forged request with their active session cookie, causing the WordPress site to execute the attacker-specified administrative action without the administrator's knowledge (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to vcita plugin admin endpoints (e.g., URLs containing meeting-scheduler-by-vcita or vcita) from unusual referrer origins or with missing/invalid nonce values.
• Logs: WordPress admin audit logs (if enabled) recording unexpected changes to vcita plugin settings or booking configurations, particularly at times inconsistent with normal administrator activity.
• Network: HTTP requests to WordPress admin-ajax.php or plugin-specific endpoints originating from external or unfamiliar referrer domains.
• File System: Unexpected changes to vcita plugin configuration files or WordPress options table entries related to the vcita plugin.

The vendor has released version 4.6.0 of the Online Booking & Scheduling Calendar for WordPress by vcita plugin, which addresses this vulnerability. All users should update to version 4.6.0 or later immediately via the WordPress plugin dashboard. As interim mitigations for sites that cannot be patched immediately: implement Content Security Policy (CSP) headers, ensure WordPress security plugins with CSRF protection are active, restrict administrative access to trusted IP ranges, and educate administrators about phishing risks. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).