Junglewise Threat Intelligence

CVE-2026-9721: chuhpl Book a Room Event Calendar CSRF in settings_form

CVE-2026-9721 · Severity: medium · CVSS 4.3 · Published 2026-06-24

Executive brief

The Book a Room Event Calendar plugin for WordPress, used for managing room bookings and events, contains a security flaw that allows attackers to change its configuration. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify sensitive settings, such as database connection details and encryption keys. This could lead to service disruptions or unauthorized redirection of plugin data to an external server controlled by the attacker.

Technical details

The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the settings_form() and update_settings() functions. The plugin's options page handler processes the 'action' POST parameter and calls update_settings() to persist configuration data via update_option() without verifying a security nonce. An unauthenticated attacker can exploit this by inducing a logged-in administrator to submit a forged request, typically via social engineering or a malicious link. Successful exploitation allows the attacker to overwrite critical plugin settings, including the external database host, credentials, encryption keys, and registration URLs. All versions up to and including 1.9 are affected.

Affected products

  • chuhpl Book a Room Event Calendar <= 1.9

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References