CVE-2025-10308 in Astro Booking Engine Plugin
Summary
by MITRE • 08/14/2026
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The Astro Booking Engine plugin for WordPress presents a critical cross-site request forgery vulnerability that affects all versions through 1.4.0, creating a significant security risk for WordPress sites utilizing this plugin. This vulnerability stems from the absence of proper nonce validation within the plugin's options deletion functionality, which represents a fundamental flaw in the plugin's security architecture and directly violates established web application security principles. The vulnerability operates by exploiting the trust relationship between the web application and its users, allowing unauthenticated attackers to manipulate the plugin's administrative functions through carefully crafted malicious requests.
The technical implementation of this CSRF flaw demonstrates a complete failure in implementing proper request authenticity verification mechanisms within the plugin's backend operations. When administrators perform actions such as deleting plugin settings or configuration data, the system should validate that these requests originate from legitimate administrative sessions through nonce tokens or similar authentication mechanisms. Without this validation, any attacker who can convince an administrator to click on a malicious link or visit a compromised website can execute unauthorized administrative commands against the vulnerable WordPress installation. This represents a classic CSRF attack vector where the attacker leverages the administrator's existing authenticated session to perform actions without their knowledge or consent.
The operational impact of this vulnerability extends beyond simple data loss, as it provides attackers with complete control over the plugin's configuration and potentially exposes the broader WordPress installation to additional attack surfaces. When an administrator deletes all plugin settings through a forged request, they effectively remove all custom configurations that may include critical booking engine parameters, user access controls, or integration settings that could compromise the site's overall functionality and security posture. This vulnerability directly maps to CWE-352, which specifically addresses Cross-Site Request Forgery vulnerabilities in web applications. The attack vector aligns with ATT&CK technique T1078.004, which covers legitimate credentials in cloud environments, as it exploits the administrator's authenticated session to perform unauthorized actions.
Organizations running affected versions of the Astro Booking Engine plugin face significant risks including potential service disruption, data integrity compromise, and possible escalation to more severe attacks if the compromised plugin has access to sensitive user or booking information. The vulnerability requires minimal effort from attackers to exploit, as it only necessitates social engineering to trick administrators into clicking malicious links rather than requiring sophisticated attack techniques or privileged access to the target system. Mitigation strategies should include immediate upgrade to versions that implement proper nonce validation, implementation of additional security measures such as request origin verification, and deployment of web application firewalls or security monitoring solutions that can detect and block suspicious administrative requests. Administrators should also conduct thorough security reviews of all installed plugins to identify similar vulnerabilities and ensure that proper input validation and authentication mechanisms are consistently applied across the entire WordPress ecosystem.