CVE-2025-10308

Name of the Vulnerable Software and Affected Versions Astro Booking Engine versions prior to 1.4.1

Description The Astro Booking Engine plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw. This occurs because the options deletion functionality lacks nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user. Consequently, an unauthenticated attacker can delete all plugin settings by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 1.4.0.