CVE-2026-9721

Name of the Vulnerable Software and Affected Versions Book a Room Event Calendar versions prior to 2.0

Description The Book a Room Event Calendar plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing an action they did not intend to. The issue exists in the settings form() and update settings() functionality due to missing or incorrect nonce validation. A nonce is a unique token used to verify that a request was intentionally sent by the user. The plugin's options page handler uses the action POST parameter to call update settings(), which saves configuration details—including the external database host, username, password, prefix, database name, encryption key, and registration page URL—via update option(). Because the plugin fails to generate or verify nonces, unauthenticated attackers can modify these database connection settings by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 1.9. As a temporary workaround, restrict access to the plugin settings page to only essential administrators until the update is applied.